Welcome to the Gibraltar Regulatory Authority website


The Data Protection Act will take effect on the 1st June and shall grant new rights to individuals regarding how their personal data are collected and used by both private and public sector bodies.

People processing personal data (known as data controllers or data processors) shall now be obliged to obey new rules governing how they collect and use data. Including these are the requirements to register with the Data Protection Commissioner and to comply with Subject Access Requests.

Registration requirements

Most businesses (except those whose data processing is of a wholly manual data) are required to register with the Data Protection Commissioner setting out what kinds of personal information they process, for what purposes they keep it, to whom the information is disclosed, and related details. It is recommended that you register online as this will automatically generate the form necessary for you to sign and return to the Data Protection Commissioner. There is a small one-off fee of 20 involved along with an on-going responsibility to maintain your registration updated. Although the Data Protection Commissioner will be accepting registrations from 1st June you are strongly advised to register on-line as from 1st July when on-line registration will be available.

For further information please contact the Gibraltar Regulatory Authority.

Subject Access Requests

An individual has a right to be given a copy of his or her own personal data upon payment of a fee which is generally no more than 10 (the GHA and Law Enforcement Agencies will be entitled to charge 20 if the request is very complex and involved). The request must be made in writing to the person who controls the data and you must receive a reply within 28 days after identifying yourself fully to the satisfaction of that person.

For further information please contact the Gibraltar Regulatory Authority

31st May 2006