LexLint

Know the law your code answers to.

Law / Saint Lucia

Data Protection Act, Commissioner, offences and penalties

Act 11 of 2011, ss. 5-31 and 69-74 (Commissioner, offences and penalties)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • The Data Protection Commissioner has not been appointed and Part 2's investigation, information-notice and enforcement-notice powers are not in force, so no data controller currently answers to an operating supervisory authority under this Act.
  • Part 7's general offence and penalty provision, section 71, is enacted and not in force, so a contravention of a provision that states no penalty of its own currently carries none under this Act.
  • The one enforceable penalty is the fine under section 34(5): a data controller who processes personal data without the required consent is liable on summary conviction to a fine not exceeding $25,000, the 2015 Act having removed the alternative of imprisonment.
  • Section 44's unlawful-disclosure offence and section 45's transfer restriction are both enacted and, like the rest of the Act outside sections 32 to 43, not in force.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Contravening the consent requirement in section 34 is the only offence under the Act now in force, carrying a fine of up to $25,000 on summary conviction (s. 34(5), as amended by the 2015 Act, which deleted the alternative of imprisonment). The general offence and penalty provision (s. 71, Part 7), which would fine a contravention of any other provision up to $10,000 for an individual or $100,000 for a body corporate where no specific penalty is stated, is enacted and not in force.

Penalty structure

Fine under section 34(5) for processing personal data without the required consent, as amended by the 2015 Act, which deleted the alternative of imprisonment; this is the only penalty in force under the Act. Section 71's general penalty (up to $10,000 for an individual or $100,000 for a body corporate) is enacted and not in force.

Rule
Fixed only
As of
19 September 2026
Currency
XCD
Fixed cap
25,000

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Part 2, sections 5 to 31, would establish a Data Protection Commissioner with functions including maintaining a register of data controllers and of processing operations, verifying compliance on the Commissioner's own motion or a data subject's request, investigating complaints, issuing information notices and enforcement notices, and referring matters to the Director of Public Prosecutions.

Part 7, sections 69 to 74, would give a right of appeal to the Court, and section 71 would make contravening the Act an offence carrying, where no specific penalty is provided, a fine of up to $10,000 for an individual or $100,000 for a body corporate. Both Parts are enacted and not in force, so Saint Lucia has no operating Data Protection Commissioner and the Act's general offence and penalty provision does not bind.

The one penalty in force sits inside the commenced consent duty rather than in Part 7: section 34(5) makes a data controller who contravenes the consent requirement in section 34 liable, on summary conviction, to a fine not exceeding $25,000. The 2015 Act deleted the alternative of imprisonment from that penalty and from the general penalty in section 71(2)(a), leaving both as fines alone.

The same Act inserted section 12A, which lets the Commissioner require a department of government to prepare a privacy impact assessment and submit it for approval. Section 44, titled Unlawful disclosure of personal data, sits in Part 3 alongside the data-controller obligations but is, like section 45, enacted and not in force.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

Data Protection Act No. 11 of 2011, Saint Lucia, full text of the Act as enacted

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app