Law: The Grenada Data Protection Act, No. 1 of 2023 (GDPA)

Regulator: The Bill provides for the establishment of the Information Commission.

Summary: On May 10, 2023, the Grenada Data Protection Act, No. 1 of 2023 (GDPA) was published in the Official Gazette, following its assent by the Deputy to the Grenada Governor-General. The GDPA will come into effect on a day to be appointed by the Prime Minister by Order in the Official Gazette, and the Prime Minister may appoint different dates for different provisions of the GDPA.

The GDPA aims to establish a comprehensive data protection framework in Grenada, by providing data subject rights such as the right to access and rectification, establishing seven data protection principles, including data integrity and disclosure, as well as establishing restrictions to the processing of sensitive data. Furthermore, the GDPA provides for the creation of the Information Commission and defines its powers in investigating complaints and issuing notices. Additionally, the GDPA grants protection for whistleblowers. Notably, the GDPA does not set out specific requirements for data processing notifications or data transfers. Finally, the GDPA sets out the offenses and corresponding penalties.