Data protection & privacy laws in Guyana (2026)

The Data Protection Act 18 of 2023 was passed by the National Assembly, gazetted on 16 August 2023, and fully entered into force on 1 January 2025, after a transitional period for compliance.

The Act establishes a Data Protection Office headed by a commissioner appointed by the President. Aneal Giddings (former Deputy Chief Elections Officer of GECOM) was appointed as the first Data Protection Commissioner on 2 January 2026; prior to this the office had not been operationalised.

Data controllers must register with a Register of Data Controllers before processing personal data; data processors must similarly register. Controllers not established in Guyana must nominate a local representative. Personal data must be processed lawfully, fairly, transparently, and only for specified, explicit, and legitimate purposes.

Data controllers must notify the Data Protection Commissioner without undue delay and no later than 72 hours after becoming aware of a personal data breach, mirroring the GDPR standard.

Individuals hold rights including access, correction, erasure, and the right to object in writing to processing at any time. Data subjects who suffer damage or distress from a contravention are entitled to compensation from the responsible controller or processor.

Administrative fines can reach GYD 20 million for serious violations; intentional contraventions attract criminal penalties including fines and imprisonment. The commissioner has investigative powers to handle complaints about data processing abuses.