🇬🇩Data Protection Act, 2023
Data Protection Act, 2023
The Act covers public bodies and private bodies processing personal data in commercial transactions. It uses consent and enumerated necessity conditions, and establishes notice, disclosure, security, retention, integrity and access principles.
Not yet treated as operative
The enacted text states that it comes into operation on a day appointed by the Minister by Gazette Order, with different dates possible for different provisions. VDPO did not identify an official commencement order as at 27 August 2026, so these controls are labelled readiness-only and should not be represented as current legal duties.
Distinctive readiness points
The Act requires formal procedures implementing the principles and a self-assessment at least once every five years. Its access procedure uses a sixty-calendar-day response period, and non-established organisations using equipment or network services in Grenada must prepare to nominate a local representative.