Data protection & privacy law in Saint Lucia (2026)
Data protection in Saint Lucia: comprehensive law.
Saint Lucia has a comprehensive, cross-sector Data Protection Act (Cap. 8.18) that fully entered into force on 1 January 2025 after a phased commencement beginning in 2023. The Act establishes core data-protection principles, a registration regime for data controllers, data-subject rights, and an independent supervisory authority (the Data Protection Commissioner) with investigation and enforcement powers. It applies to all organisations processing personal data in Saint Lucia, including foreign entities.
Legal framework
Data Protection Act, Cap. 8.18 (enacted 2011, amended 2015, partially in force January 2023, fully in force 1 January 2025), supervised by the Data Protection Commissioner, Saint Lucia
Key points: data & privacy in Saint Lucia
Legislative basis
The Data Protection Act Cap. 8.18 was enacted in 2011, amended by the Data Protection (Amendment) Act No. 2 of 2015, partially proclaimed in January 2023, and brought fully into force on 1 January 2025.
Supervisory authority
The Data Protection Commissioner is the independent supervisory authority, appointed by the Governor General on the advice of the Prime Minister after consultation with Cabinet and the Leader of the Opposition. The Commissioner oversees registration, compliance, investigations, and can impose administrative penalties.
Data controller obligations
Data controllers must register with the Data Protection Commissioner before processing personal data, declaring the categories of data, purposes, intended recipients, and any cross-border transfers. They must implement appropriate technical and organisational security measures (s. 42) and destroy personal data when the processing purpose lapses (s. 43).
attorneygeneralchambers.com attorneygeneralchambers.com attorneygeneralchambers.com
Data-subject rights
The Act grants rights of access, rectification, erasure, and objection to processing (including an absolute right to object to direct-marketing use). Data subjects may also revoke consent at any time for compelling legitimate grounds.
Sensitive personal data
Section 36 imposes heightened restrictions on processing special categories of data (e.g., health, racial or ethnic origin, political opinions, religious beliefs), generally requiring explicit consent or another specific statutory ground.
Cross-border data transfers
Section 45 prohibits transfer of personal data outside Saint Lucia unless the destination country or territory has comparable safeguards for data-subject rights, or the Commissioner has approved terms ensuring adequate safeguards.
Sources
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act
- govt.lc/privacy-data-prot
- bartlettmorgan.com/2023/03/24/saint-lucia-brings-its-privacy-law-into-force/
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act/part-2-appointment-functions-
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act/section-45
- dataguidance.com/jurisdictions/saint-lucia
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act/section-5
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act/section-42
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act/section-43
- attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act/section-36
Next for Saint Lucia: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026