Accessibility

Font size

Filters

Highlight

Colour

Zoom

Important Notice

Gibraltar’s data protection law is set out principally in the Gibraltar General Data Protection Regulation (“Gibraltar GDPR”) and the Data Protection Act 2004 (“DPA”). The framework has developed over time in light of Gibraltar’s legal relationship with the UK and the EU, while maintaining core data protection standards aligned with EU Law. With effect from 15 July 2026, the Gibraltar GDPR was amended by the Data Protection Regulations 2026. These amendments reinstate the EU General Data Protection Regulation 2016/679 framework in Gibraltar, subject to certain Gibraltar-specific modifications. The amended Gibraltar GDPR and the DPA must be read together. The GRA is reviewing and updating references to these arrangements across the Data Protection sections of its website, including downloadable documents. Some webpages or documents may therefore contain references that are out of date. This notice is provided for general information only and does not replace the legislation currently in force. Users should refer to the current legislation where necessary.

DATA PROTECTION COMPLAINTS

Gibraltar’s Information Commissioner has statutory functions in law, for which he must carry out certain tasks under the Data Protection Act 2004 (the “DPA”), the Gibraltar General Data Protection Regulation (“Gibraltar GDPR”) and/or other relevant data protection legislation.

Amongst said tasks, the Information Commissioner is required, to the extent considered appropriate, to investigate complaints lodged or otherwise conduct investigations on the application of the Gibraltar GDPR and DPA, and to provide an outcome to the complainant. In practice, this means that there can be several outcomes following a complaint. The Information Commissioner may for example:

  • Decide that the organisation has done nothing wrong and there hasn't been an infringement of the law.
  • Log the complaint and use it for future intelligence but do nothing further with it.
  • Ask the organisation to take further steps to help resolve the complaint or explain their position more clearly to the complainant.
  • Make recommendations to the organisation about how they can improve their information rights practices.
  • Take regulatory action, but this is only in the most serious cases. Even if regulatory action is not taken, the Information Commissioner will keep a record of the complaint (in line with relevant retention periods) to help build up a picture of how well an organisation is complying with relevant data protection law.

Importantly, the Information Commissioner is unable to award compensation to individuals for data protection infringements. Data subjects have a right to claim compensation from an organisation if they have suffered damage as a result of a data protection law infringement. This includes both material damage, for example where there has been financial loss, or non-material damage, for example in cases of distress. The organisation may simply agree to pay the compensation in certain circumstances. However, if they do not agree to pay, the data subject needs to turn to the courts if they wish to pursue a claim for compensation. The Information Commissioner strongly recommends individuals to take independent legal advice on the strength of a case before taking any claim to court.

If a data subject wishes to submit a complaint to the Information Commissioner’s Office or seeks to appoint a representative to liaise with our office, certain verifications must be carried out before engagement. This is to ensure that the Information Commissioner complies with relevant laws requiring that information and/or personal data relating to a matter be disclosed only to authorised persons.

The required documentation is set out in the Information Commissioner’s “Policy - Identity and Authority Verification”, in the drop down below. 

Failure to provide the adequate identification verification documents may mean we are unable to proceed with the complaint.

Complaint form

Please use the form below if you wish to submit a complaint to the Gibraltar Regulatory Authority, as the Information Commissioner.