Data Protection Act 2021 Revision, application, principles and data subject rights
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 30 September 2019.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Have a lawful basis for collecting and processing personal data, and hold it only for specified purposes.
- Give a data subject access to their personal data on request, and let them object to processing or to processing for direct marketing.
- Do not base a decision that significantly affects a data subject solely on automated processing of their personal data without notifying them and honouring a request to reconsider.
If you get it wrong
Private right of actionYes
What it reaches
Obligation class
Data subject rights, Consent, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act binds a data controller established in the Islands, or one processing personal data in the Islands otherwise than in transit, to collect personal data fairly and lawfully, hold it only for specified purposes, keep it accurate, and secure it against unauthorised access.
A data subject may access personal data held about them, require a controller to stop processing or to stop processing for direct marketing, and object to a decision based solely on automated processing of their personal data that significantly affects them. A person who suffers damage from a data controller's contravention of the Act has a statutory cause of action for compensation.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisions
Read the law
Data Protection Act (2021 Revision), Office of the Ombudsman