Data Protection Act, No. 1 of 2023
Data Protection Act, No. 1 of 2023
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Commencement not set.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- This Act is not yet in force; commencement awaits a ministerial Order in the Gazette.
- Establish a lawful basis, ordinarily the data subject's consent, before processing personal data about them.
- Do not process sensitive personal data, including health, genetic, biometric, sex-life, political or religious information, except on the Act's narrower grounds, ordinarily the data subject's written consent.
- Give the data subject notice of the purpose and source of collection, their access and rectification rights, and whether supplying the data is obligatory.
- Do not disclose personal data for a new purpose or to a new class of recipient without the data subject's consent.
- Take practical steps to secure personal data against loss, misuse or unauthorised access, and do not retain it longer than necessary.
- Give a data subject access to, and let them rectify, their personal data on written request.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Intentionally disclosing personal information in contravention of the Act, or collecting, storing or disposing of it in a manner that contravenes the Act, is an offence (s. 39), punishable under the default penalty of s. 42(1): a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment, or a lesser fine or term on summary conviction.
Penalty structure
Default penalty under s. 42(1) for an offence carrying no specifically stated penalty, including intentional disclosure of personal information under s. 39: a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years on summary conviction, or a fine not exceeding one hundred thousand dollars or imprisonment not exceeding five years on conviction on indictment. Processing sensitive personal data in breach of s. 21 carries its own higher penalty under s. 21(3): a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years on conviction on indictment. The Act states amounts in dollars; Grenada's currency is the Eastern Caribbean dollar (XCD).
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- XCD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Information Commission
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Retention, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Data Protection Act, No. 1 of 2023 requires a data user to have the data subject's consent, or one of a limited set of alternative lawful grounds, before processing personal data, and to process sensitive personal data (including health, genetic, biometric, sex-life, political, religious and criminal-record information) only on narrower grounds such as the data subject's written consent.
It requires notice to the data subject of the purpose and source of collection, and bars disclosure for a new purpose or to a new class of recipient without consent. It also requires practical security measures, retention no longer than necessary, and data-subject rights of access and rectification, enforced by an Information Commission the Act establishes. A data subject who suffers damage from a contravention of the Act by a public or private body may bring civil proceedings in the High Court.
Section 1(2) delays the Act's commencement to a day the Minister appoints by Order in the Gazette, and no commencement Order has been located, so the Act has been assented and gazetted but is not yet in force.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_biometrics