Important Notice

Gibraltar’s data protection law is set out principally in the Gibraltar General Data Protection Regulation (“Gibraltar GDPR”) and the Data Protection Act 2004 (“DPA”). The framework has developed over time in light of Gibraltar’s legal relationship with the UK and the EU, while maintaining core data protection standards aligned with EU Law. With effect from 15 July 2026, the Gibraltar GDPR was amended by the Data Protection Regulations 2026. These amendments reinstate the EU General Data Protection Regulation 2016/679 framework in Gibraltar, subject to certain Gibraltar-specific modifications. The amended Gibraltar GDPR and the DPA must be read together. The GRA is reviewing and updating references to these arrangements across the Data Protection sections of its website, including downloadable documents. Some webpages or documents may therefore contain references that are out of date. This notice is provided for general information only and does not replace the legislation currently in force. Users should refer to the current legislation where necessary.

GIBRALTAR GDPR & DPA DATA SHARING CODE OF PRACTICE

This document provides detailed guidance and good practice for the sharing of personal data between organisations. It also provides a general framework which organisations can use to develop their own data sharing arrangements and ensure compliance with the Gibraltar General Data Protection Regulation (the “Gibraltar GDPR”) and the Data Protection Act 2004 (“DPA”).

The code provides organisations with information on how they can share personal data in a fair, safe and transparent manner and guide them through the practical steps they need to take to share personal data while protecting individuals’ rights and freedoms. The code aims to provide clarity and guidance on how personal data can be shared in compliance with the Gibraltar GDPR and the DPA.