Antigua and BarbudaData Protection Act, 2013, information commissioner and enforcement
Data Protection Act, 2013, ss. 21-27 (information commissioner and enforcement)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not intentionally disclose personal information of another person in contravention of this Act, and do not collect, store or dispose of personal information in a manner that contravenes it, each a criminal offence.
- Expect a contravention of this Act for which no penalty is otherwise specified to carry, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
- Comply with a requirement the Information Commissioner specifies in an enforcement notice or an information notice, and expect an appeal against that requirement, or against a decision of the Information Commissioner, to lie to the Eastern Caribbean Supreme Court.
- Expect the Information Commissioner and anyone acting on the Commissioner's behalf to keep confidential the information that comes to their knowledge in enforcing this Act, and to report annually to Parliament on data protection activities under it.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unlawfully processing sensitive personal data is an offence under s. 18(3) carrying a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both. A contravention for which no other penalty is specified is an offence under the s. 23 general penalty: for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on indictment; for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
Penalty structure
Five hundred thousand dollars is the ceiling the Act itself states, for a body corporate convicted on indictment under s. 23(2)(b). An individual's general-penalty ceiling is lower (one hundred thousand dollars on indictment, fifty thousand on summary conviction, under s. 23(1)), and unlawfully processing sensitive personal data carries its own, separate penalty of up to two hundred thousand dollars or three years imprisonment under s. 18(3).
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- XCD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Information Commissioner (appointed under the Freedom of Information Act 2004)
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 21 assigns the Information Commissioner appointed under the Freedom of Information Act 2004 the powers, functions and duties needed to enforce this Act. Section 22 makes it an offence for a person to intentionally disclose another person's personal information in contravention of this Act, or to collect, store or dispose of personal information in a manner that contravenes it.
Section 18(3) separately makes contravening the sensitive personal data conditions in section 18(1) an offence carrying a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both.
Section 23 makes a contravention of this Act for which no other penalty is specified an offence carrying, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on conviction on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.
Section 24 gives a right of appeal to the Eastern Caribbean Supreme Court against a requirement in an enforcement notice or an information notice, against a decision of the Information Commissioner on a complaint, or against any decision of the Information Commissioner in the conduct of duties and powers under this Act.
Section 25 bars criminal or civil proceedings against the Information Commissioner, or a person acting on the Commissioner's behalf, for anything done in good faith in exercising a power, duty or function under this Act, and gives absolute privilege to words spoken and reports made in good faith in that exercise.
Section 26 bars the Information Commissioner and anyone acting on the Commissioner's behalf from disclosing information that comes to their knowledge in the conduct of their functions under this Act. Section 27 requires the Information Commissioner to include a report on data protection activities under this Act in the annual report made to Parliament under the Freedom of Information Act 2004. The Act does not arm a data subject with an independent private right of civil action.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotis_listed_company
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.