Data & Privacy · Gibraltar
Data protection & privacy law in Gibraltar (2026)
Gibraltar shaded by its data & privacy status
Data protection in Gibraltar: comprehensive law.
FrameworkGibraltar GDPR + Data Protection Act 2004 (as amended by the Data Protection Regulations 2026); enforced by the Gibraltar Regulatory Authority (GRA) as sole supervisory authority
Gibraltar has a comprehensive, GDPR-aligned personal data regime. The Gibraltar GDPR (which replaced the EU GDPR on 1 January 2021 as retained domestic law) sits alongside the Data Protection Act 2004, and was updated by the Data Protection Regulations 2026 following the UK–EU Treaty on Gibraltar. The Gibraltar Regulatory Authority (GRA) is the independent supervisory authority responsible for enforcement, guidance and complaints handling.
Key points
The regime is a GDPR-equivalent framework: the Gibraltar GDPR (post-Brexit retained GDPR) together with the Data Protection Act 2004, which addresses derogations, exemptions and national-specific provisions.
The Gibraltar Regulatory Authority (GRA) is the sole data protection authority. It investigates complaints, issues guidance, can serve information notices (with a 21-day response requirement) and impose administrative fines and penalties on controllers and processors.
The Data Protection Regulations 2026, adopted after the UK–EU Treaty on Gibraltar, amend the Gibraltar GDPR and DPA 2004 — notably by replacing references to UK adequacy regulations with references to European Commission adequacy decisions and imposing an interpretive duty aligned with EU law.
Individuals enjoy full GDPR-style rights (information, access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making). Controllers must notify the GRA of qualifying personal data breaches without undue delay and within 72 hours, and notify affected individuals where high risk arises.
Gibraltar is no longer treated as a third country for inbound personal data transfers from the EEA under the new Treaty arrangements, removing the need for Chapter V safeguards. Outbound transfers from Gibraltar rely on adequacy findings (including to the UK) and standard GDPR transfer mechanisms.
The regime applies to controllers and processors established in Gibraltar and to processing of Gibraltar data subjects' personal data by entities offering goods/services or monitoring behaviour in Gibraltar, tracking the GDPR's material and territorial scope.
Timeline - major decisions & events
The Commission confirmed the UK continues to offer adequate protection under the new Data (Use and Access) Act, after extending existing adequacy decisions to 27 December 2025. Because Gibraltar's regime mirrors the UK's and data flows freely to the UK, this directly underpins Gibraltar's cross-border transfer position.
EDPB ↗The DUAA amended the UK GDPR regime and introduced a new third-country data-protection test. As Gibraltar law tracks the UK framework for adequacy purposes, the reform sets the direction for Gibraltar's own evolving standard.
Squire Patton Boggs (Global Privacy Blog) ↗The Information Commissioner imposed a £10,000 penalty on the RGP for violations of the DPA 2004 and Gibraltar GDPR involving the personal data of hundreds of serving and retired officers. It is the largest publicly reported Gibraltar data-protection fine and signalled enforcement against public bodies.
DataGuidance ↗At the end of the EU exit transition period, the EU GDPR was superseded domestically by the 'Gibraltar GDPR', sitting alongside the retained DPA 2004. This established the current two-pillar framework supervised by the GRA as Information Commissioner.
Gibraltar Regulatory Authority ↗The GRA fined the RGP £5,000 after pocketbook entries and witness accounts from an investigation were disclosed to the wrong recipient. It was one of the first significant public-sector enforcement actions under the Gibraltar regime.
Gibraltar Regulatory Authority ↗The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 transposed Regulation (EU) 2016/679 into Gibraltar national law so the standard would survive Brexit. This is the legal vehicle that produced the Gibraltar GDPR.
UK Government (DCMS adequacy framework) ↗As part of the EU via the UK, Gibraltar became subject to the directly applicable EU General Data Protection Regulation, modernising rights, accountability obligations and large fining powers. This set the substantive standard later retained as the Gibraltar GDPR.
Gibraltar Regulatory Authority ↗Gibraltar's foundational data-protection statute transposed the 1995 EU Data Protection Directive, establishing core processing principles, data-subject rights and a supervisory Commissioner (later the GRA). Brought into operation around 2006, the DPA 2004 remains in force as supplementary national law.
Laws of Gibraltar ↗Gibraltar - other topics
Data & Privacy in other countries
Last verified 9/16/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →