Data Protection Act
Act 11 of 2011 (as amended by Act 2 of 2015), Laws of Saint Lucia, ss. 1-4, 32-43 and Schedule 2
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 31 January 2023.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Before collecting personal data directly from a person, tell them what is being collected, why, who will receive it, whether providing it is mandatory, and their rights to access, correct, and have it destroyed.
- Collect personal data only for a lawful purpose connected with your business and only where the collection is necessary for that purpose.
- Obtain a person's express consent before processing their personal data, unless a specific ground applies such as performing a contract with them, complying with a legal obligation, or a legitimate interest that does not override their privacy rights.
- Do not process a special category of sensitive personal data (racial or ethnic origin, political opinion, religious belief, physical or mental health, sexual orientation, or criminal or financial record) unless a listed ground applies, the person has given explicit consent, or the person already published it themselves.
- Keep personal data accurate and up to date, use it only for the purpose it was collected for, and destroy it once that purpose has lapsed.
- Take security measures appropriate to the risk to prevent unauthorized access to, alteration of, or loss of personal data, and make sure staff know and follow them.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Contravening the consent requirement in section 34 is an offence carrying a fine of up to $25,000 on summary conviction (s. 34(5)); the Act's general offence and penalty provision (s. 71, Part 7) is not shown as commenced, so no other currently commenced obligation in the Act carries its own stated penalty.
Penalty structure
Fine under section 34(5) for processing personal data without the required consent; this is the only penalty currently stated for a commenced provision of the Act.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- XCD
- Fixed cap
- 25,000
What it reaches
Obligation class
Consent, Disclosure, Retention, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 33 bars a data controller from collecting personal data except for a lawful purpose connected with its business and requires it to tell the data subject, at the point of collection, what is being collected, why, who will receive it, and the subject's rights of access, correction and destruction.
Section 34 bars processing personal data without the data subject's express consent unless a listed ground applies, such as performing a contract with the subject, complying with a legal obligation, or a legitimate interest that does not override the subject's privacy rights, and a breach of section 34 is an offence carrying a fine of up to $25,000.
Section 35 confines processing of sensitive personal data (racial or ethnic origin, political opinion, religious belief, health, sexual orientation, or criminal or financial record) to the grounds the Act lists, the subject's explicit consent, or data the subject has already published. Section 40 requires a data controller to keep personal data accurate and up to date.
Section 42 requires the data controller to take security measures appropriate to the risk of unauthorized access, alteration, or loss. Section 43 requires the data controller to destroy personal data once the purpose for holding it has lapsed. Section 4 binds the State as well as private actors. The Act binds a data controller established in Saint Lucia, or established elsewhere but using equipment in Saint Lucia to process data.
When LexLint raises it
processes_biometrics
Read the law
Official Act text, Revised Laws of Saint Lucia (2023 Revised Edition), Attorney General's Chambers