Gibraltar Regulatory Authority

📢 UK–EU Treaty: What does it mean for data protection in Gibraltar?

The UK–EU Treaty ensures that Gibraltar's data protection framework remains closely aligned with the EU GDPR, providing continued protection for individuals' personal data.

Key takeaways:

💡The Gibraltar GDPR has been updated through the Data Protection Regulations 2026.

📑Data protection rules continue to apply to both automated and manual processing of personal data.

💬The GRA will continue to interpret and apply data protection law in line with relevant European Data Protection Board (EDPB) guidance and decisions.

🔒Gibraltar will not be treated as a "third country" for EU data protection purposes, provided the required standards continue to be met.

🔎Existing GRA guidance remains in force unless otherwise stated.

The GRA will of course continue to monitor developments and ensure Gibraltar's data protection framework remains robust and effective.

The Gibraltar Regulatory Authority (the “GRA”), in its capacity as the Information Commissioner, is pleased to announce the launch of the “beta phase” of its Regulatory Sandbox (the “Sandbox”). This initiative provides organisations with a controlled environment to test innovative products, services, or data uses, while receiving guidance to ensure compliance with Gibraltar’s privacy and data protection laws prior to full-scale deployment.

The Sandbox is designed to reduce regulatory uncertainty and support the development of compliant solutions in emerging sectors and technologies, further strengthening Gibraltar’s position as an innovation-focused economy.

🤗Who can participate?
The Sandbox is open to organisations of all sizes and is intended for activities, services, or models that will involve the processing of personal data under Gibraltar’s data protection framework.

⚙️How it works:
The Sandbox is currently in a “beta phase”, meaning its structure, processes, and governance may evolve on experience and participant feedback.

Participation will follow a phased intake model, beginning with an “expression of interest” stage, followed by a full application process for shortlisted organisations. One project will be selected at a time to ensure appropriate oversight and regulatory support.

At the conclusion of the Sandbox process, participants will receive an “exit report” summarising their engagement, key data protection considerations and generalisable insights.

A “statement of regulatory comfort” may also be issued, where agreed in advance and subject to all participation conditions being met. Where appropriate, this will confirm that, based on the information provided during participation, the GRA has not identified any indications of non-compliance with applicable data protection laws.

📥How to apply:
Organisations wishing to participate can find more information under the “Regulatory Sandbox” tab within the “Data Protection” section of GRA website: https://www.gra.gi/data-protection/regulatory-sandbox

📧Enquiries can be directed to: [email protected]

Yesterday the GRA proudly wore blue, yellow and green in support of the 5 Half Ironmans in 5 Days challenge.

As well as taking part in our own Office Ironman challenge throughout the week, we came together for a photo to show our support for the cause. We also had an employee who supported the charity with their swimming efforts during the challenge.

Congratulations to everyone involved! 💪

8️⃣Years of GDPR 🥳

🔓 The Gibraltar Regulatory Authority’s Information Rights Division reflects on the continued importance of robust data protection standards, which remain firmly embedded within Gibraltar’s legal and regulatory framework.

8️⃣ years on, the commitment stands firm: stronger trust, clearer compliance, and uncompromising protection of personal data in a changing digital world.

🔓 The Gibraltar Regulatory Authority (“GRA”), as the Information Commissioner, hosted a Data Protection Workshop titled “Data Protection Today for a Trusted Tomorrow”.

💡 The underlying message was clear:

🔎 Data protection is no longer a niche legal topic, it is a cornerstone of trust, innovation, and resilience in the digital age.

🤝 A special note of thanks goes to all who contributed to the event including our local sectoral regulators, international data protection authorities, industry representatives, panelists, speakers, and of course, the audience for your questions and engagement throughout the day. Your active participation, insights, and willingness to engage in open dialogue were fundamental to the success of the workshop.

📣 Here’s to continuing the conversation, see you at our next event!

The Gibraltar Regulatory Authority ("GRA"), as the Information Commissioner, was pleased to host the 2026 meeting of the British, Irish and Islands Data Protection Authorities ("BIIDPA") in Gibraltar.

Bringing together data protection regulators from Bermuda, Gibraltar, Guernsey, Ireland, the Isle of Man, Jersey, Malta and the United Kingdom, the forum provided an important platform for strengthening supervisory cooperation, sharing regulatory experiences, and promoting consistency across jurisdictions.

Key discussions focused on:
• Data protection in global financial hubs
• Children’s privacy
• AI literacy and regulatory readiness
• Cybersecurity and data breach management
• Subject Access Request enforcement challenges

The meeting highlighted the importance of international cooperation in addressing shared regulatory challenges and ensuring strong, consistent protection of individuals’ data rights in an evolving digital landscape.

BIIDPA's evening programme offered an opportunity for delegates to experience Gibraltar’s history and cultural heritage in a more informal setting.

The GRA thanks all participating authorities for their valuable contributions and continued commitment to collaboration and engagement.

🔐 Data Protection Today for a Trusted Tomorrow 🔐
👉 Session 5: Cybersecurity 🔎

Cybersecurity is no longer just a technical function, it is a strategic business priority.

Join us for an engaging discussion exploring how organisations can strengthen resilience, respond effectively to incidents, and build trust in an increasingly complex digital landscape.

🎤 Featuring industry experts and regulatory leaders from Gibraltar, Jersey, the Isle of Man, and the private sector.

📅 Wednesday 20 May 2026
📌 The Rock Hotel, Gibraltar
🎟️ Tickets available here: https://www.buytickets.gi/events/data-protection-today-for-a-trusted-tomorrow-1247

🔓Data Protection Today for a Trusted Tomorrow 🔒
🔹Session 4: AML and Data Protection🔹

This session will explore how robust information sharing can coexist with key privacy principles and how strong data protection frameworks can help build trust in the fight against financial crime.

🎤 Featuring expert speakers from Gibraltar and Guernsey.

🎟️ Remaining tickets available here: https://www.buytickets.gi/events/data-protection-today-for-a-trusted-tomorrow-1247

🔓 Data Protection Today For a Trusted Tomorrow 🔒
🦹 Session 3: Children’s Privacy 👶

Children’s privacy has never been more important. In today’s increasingly data-driven digital environment, young people engage with online platforms in ways that present unique risks to their privacy, wellbeing, and development.

This important panel session will bring together international regulatory perspectives, legal insights, and youth practitioner experience to examine how children interact online and the challenges they face.

Discussions will also explore the growing discourse around persuasive technology and its impact on young people, as well as emerging issues such as sharenting and wider questions of accountability.

🎟️ Limited tickets still available: https://lnkd.in/eQhFp_2S