Data Protection Act, No. 1 of 2023

The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of personal data in respect of commercial transactions in Grenada, reaching a person established in Grenada and, under section 4(2)(b), a person established elsewhere who uses equipment or network services in Grenada for processing personal data.

Section 7 bars a data user from processing personal data about a data subject without the data subject's consent, subject to the alternative grounds in section 7(2) such as contractual necessity, a legal obligation, protecting the data subject's interests, the administration of justice or the exercise of a statutory or government function, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity and adequate but not excessive for that purpose.

Section 9 bars a data user from disclosing personal data, without the data subject's consent, for a new purpose or to a new class of recipient, and section 20 lets a data user disclose personal data for another purpose only where the data subject consents, the disclosure is necessary to prevent or detect crime or for investigations, the disclosure is required or authorised by an enactment or court order, or the Minister deems the disclosure justified as being in the public interest.

Section 10 requires a data user to take practical steps to protect personal data against loss, misuse, unauthorised access, alteration or destruction, including obtaining a data processor's guarantees of its own technical and organisational security measures, and section 11 bars retention of personal data longer than necessary for the purpose it was processed for.

Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date, and section 14 requires every data user to establish formal procedures implementing these principles and to review them at least once every five years.

Sections 22 and 23 exempt personal data processed for an individual's own personal, family, household or recreational purposes, and let the Minister exempt further data users or provisions by Order published in the Gazette, alongside the Act's own exemptions for crime prevention and investigation, health information whose disclosure would cause serious harm, anonymised statistics and research, court orders, regulatory functions, and journalistic, literary or artistic purposes meeting a public interest test.

Section 1(2) delays the Act's commencement to a day the Minister appoints by Order in the Gazette, and no commencement Order has been located, so the Act has been assented and gazetted but is not yet in force.