Skip to content
World Watch

Data protection & privacy law in Guyana (2026)

Data protection in Guyana: comprehensive law.

Guyana enacted a comprehensive personal-data protection law, the Data Protection Act 18 of 2023, receiving presidential assent on 16 August 2023 and coming fully into force on 1 January 2025. The Act is modelled closely on GDPR principles and covers all public and private entities that collect, process, or disseminate personal data. Institutional implementation has lagged: the Data Protection Commissioner (Aneal Giddings) was only appointed in February 2026, meaning active enforcement is nascent as of mid-2026.

Last verified Official sources first · MethodologyCompare Guyana with other countries

Legal framework

Data Protection Act 18 of 2023 (Act No. 18 of 2023), supervised by the Data Protection Commissioner under the Data Protection Office

Key points: data & privacy in Guyana

  1. Enactment & commencement

    The Data Protection Act 18 of 2023 was passed by the National Assembly, gazetted on 16 August 2023, and fully entered into force on 1 January 2025, after a transitional period for compliance.

    parliament.gov.gy officialgazette.gov.gy

  2. Supervisory authority

    The Act establishes a Data Protection Office headed by a commissioner appointed by the President. Aneal Giddings (former Deputy Chief Elections Officer of GECOM) was appointed as the first Data Protection Commissioner on 2 January 2026; prior to this the office had not been operationalised.

    demerarawaves.com demerarawaves.com

  3. Controller & processor obligations

    Data controllers must register with a Register of Data Controllers before processing personal data; data processors must similarly register. Controllers not established in Guyana must nominate a local representative. Personal data must be processed lawfully, fairly, transparently, and only for specified, explicit, and legitimate purposes.

    parliament.gov.gy dpocaribbean.com

  4. Breach notification

    Data controllers must notify the Data Protection Commissioner without undue delay and no later than 72 hours after becoming aware of a personal data breach, mirroring the GDPR standard.

    dpocaribbean.com jackalli.com

  5. Data subject rights

    Individuals hold rights including access, correction, erasure, and the right to object in writing to processing at any time. Data subjects who suffer damage or distress from a contravention are entitled to compensation from the responsible controller or processor.

    dpocaribbean.com parliament.gov.gy

  6. Penalties

    Administrative fines can reach GYD 20 million for serious violations; intentional contraventions attract criminal penalties including fines and imprisonment. The commissioner has investigative powers to handle complaints about data processing abuses.

    jackalli.com dpi.gov.gy

Sources

  1. parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023
  2. officialgazette.gov.gy/index.php/publications/2237-extraordinary-gazettes-16th-august-2023-a
  3. dpi.gov.gy/data-protection-bill-passed-in-national-assembly/
  4. demerarawaves.com/2026/02/07/former-top-gecom-official-now-data-commissioner/
  5. demerarawaves.com/2025/11/18/activate-data-protection-law-to-prevent-repeat-of-politica
  6. dpocaribbean.com/dpo-digest/f/the-guyana-data-protection-act-principles-rights-obligat
  7. jackalli.com/ja/jc/media/jackalli_act_Data-Protection_2023_summary.pdf

Next for Guyana: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026