Data Protection Act, No. 1 of 2023, sensitive personal data

Data Protection Act, No. 1 of 2023, s. 21 (sensitive personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

This Act is not yet in force; commencement awaits a ministerial Order in the Gazette.
Do not process sensitive personal data, including health, genetic, biometric, sex life, political or religious information, except on one of the Act's listed grounds, ordinarily the data subject's written consent.
Where you rely on a ground other than consent, confirm it is one the Act lists: an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained, medical purposes handled under a duty of confidentiality, legal proceedings or advice, the administration of justice, a government function, or information the data subject has already made public.
Expect intentional or unauthorised processing of sensitive personal data outside these grounds to carry a criminal penalty of up to two hundred thousand dollars or two years' imprisonment on indictment, in addition to any offence under the Act's general penalty provisions.

What it reaches

Obligation class

Prohibition, Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 21 bars a data user from processing sensitive personal data, defined in section 2 to include an individual's physical or mental health or condition, racial or ethnic origin, genetic data, biometric data that uniquely identifies an individual, sex life, political opinions, religious or philosophical beliefs, and the commission or alleged commission of an offence, except on the conditions section 21(1) lists.

The data subject's written consent to the processing of the sensitive personal data is the first of those conditions, and the others include processing necessary to an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained or has been unreasonably withheld, medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, legal proceedings or advice, the administration of justice, a statutory or government function, another purpose the Minister thinks fit, or information the data subject has made public.

A person who contravenes section 21(1) commits an offence and is liable, on conviction on indictment, to a fine not exceeding two hundred thousand dollars or imprisonment for a term not exceeding two years, or both.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
handles_health_records

Read the law

Official text of the Data Protection Act, No. 1 of 2023, Laws of Grenada consolidated Acts database (laws.gov.gd), archived copy

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.laws.gov.gd/index.php/acts/971-act-no-1-of-2023-data-protection-2023/viewdocument/971

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app