BREXIT

25 May 2018 up to and including 31 December 2020 - Until 31 December 2020, the EU General Data Protection Regulation 2016/679 (“EU GDPR”) continued to form part of Gibraltar law.

1 January 2021 up to and including 14 July 2026 - However, following the end of the Brexit transition period, the EU GDPR was superseded by the Gibraltar General Data Protection Regulation (the “Gibraltar GDPR”) on 1 January 2021. Notwithstanding, Gibraltar’s data protection regime remained largely the same, as Gibraltar committed to maintaining the high standards of the EU GDPR, which was in effect mirrored within domestic law by way of the Gibraltar GDPR.

Following the Brexit transition period, Gibraltar’s EU adequacy application remained ongoing, and the requirements governing the transfer of data to Gibraltar from the EEA therefore changed. Data controllers/processors that are subject to the EU GDPR must now ensure to make appropriate arrangements to allow the flow of personal data from the EEA to Gibraltar (e.g. by implementing Standard Contractual Clauses – see Chapter V of the Gibraltar GDPR in respect of International Transfers).

In the following, the Information Commissioner provides links to a series of guidance notes and resources to assist organisations transition into the new post-Brexit regime. Periodic workshops on Brexit are also held by the Information Commissioner’s office.

For further information please contact our office at privacy@gra.gi