Today the Gibraltar Regulatory Authority (“GRA”), as the Data Protection Commissioner, has published the fourth guidance note on the European Union’s General Data Protection Regulation (“GDPR”), which will come into force in Gibraltar on the 25th May 2018.

The introduction of the GDPR will represent a significant development in data protection law, with new or revised requirements concerning the appointment of staff to ensure data protection compliance, easier rights of access to data, and notification of data breaches to individuals. Organisations (both private and public) need to make sure that they are ready before the new law comes into effect in May 2018.

The GRA is the nominated authority responsible for the enforcement of the data protection law in Gibraltar and carries out the functions assigned to it to uphold the rights of individuals and their privacy. As part of its efforts to promote data protection compliance and good practice, the GRA has set out to issue a set of guidance notes aimed at helping organisations improve their practices and prepare for the GDPR.

The guidance note published today is the fourth in a series that the GRA will issue in the run-up to May 2018. The guidance note provides general advice on the requirement for organisations to conduct a Data Protection Impact Assessment (“DPIA”) for any high-risk data processing activity.

DPIAs are not a new concept, and they are currently used to comply with current data protection laws. Under the GDPR however, they will become mandatory where data processing is “likely to result in a high risk to the rights and freedoms of natural persons”.

The guidance note is available on the data protection section of the GRA’s website - www.gra.gi/data-protection

For further information please contact the Information Rights Division of the GRA on +350 200 74636 or email [email protected]

{fcomment}