Data protection & privacy laws in British Virgin Islands (2026)

The Data Protection Act, 2021 (Act No. 3 of 2021) was assented to and came into force on 9 July 2021, marking the first standalone data-protection regime in the BVI.

The Act applies to any public or private body that processes, controls, or authorises the processing of personal data within the BVI, including foreign entities using BVI-based equipment for data processing.

Data subjects have rights to access, rectification, erasure (right to be forgotten), restriction of processing, objection to direct marketing, and data portability — mirroring the GDPR rights catalogue.

Personal data may not be transferred outside the BVI without the data subject's consent or proof of adequate safeguards in the recipient jurisdiction; the BVI has not yet obtained an EU or UK adequacy decision, and implementing regulations on transfer mechanisms (e.g. standard contractual clauses) had not been issued as of early 2026.

The Office of the Information Commissioner (appointed by the Governor) investigates complaints, issues information and enforcement notices, and may seek search warrants from a Magistrate; corporate penalties reach USD 500,000 and individuals face fines up to USD 100,000 and/or imprisonment up to five years.

As of February 2025, the Information Commissioner's office had not been fully staffed, meaning active enforcement has been limited in practice despite the statute being fully in force since 2021.