Antigua and Barbuda

Section 5 requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, unless the processing is necessary for a listed alternative ground such as performing a contract, complying with a legal obligation, protecting the data subject's vital interests, the administration of justice, or exercising a function conferred by law, and requires every such processing to be for a lawful purpose directly related to the data user's activity, necessary for that purpose, and adequate but not excessive.

Section 7 bars disclosing personal data for a purpose other than the one notified at collection, or a purpose directly related to it, without the data subject's consent, subject to the exceptions in section 17.

Section 17 lets a data user disclose personal data for a different purpose where the data subject consents, the disclosure prevents or detects crime or is required or authorized by law or a court order, the data user reasonably believed it had the right to disclose or would have had the data subject's consent, or the Minister determines the disclosure is justified in the public interest.

Section 8 requires a data user to take practical security steps against loss, misuse, unauthorized or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, the security measures built into that storage, and the reliability of personnel with access, and requires the same guarantees from a data processor engaged on the data user's behalf.

Section 9 bars keeping personal data longer than necessary for the purpose it was processed for. Section 10 requires a data user to keep personal data accurate, complete, not misleading and up to date, having regard to the purpose it was collected and further processed for.

Section 19 exempts personal data processed for an individual's personal, family or household affairs entirely, and exempts data processed for crime prevention or investigation, apprehension or prosecution of offenders, or tax assessment and collection, for preparing statistics or conducting research, for a court order or judgment, or for discharging regulatory functions, from the General, Notice and Choice, Disclosure and Access Principles, and exempts data processed only for journalistic, literary or artistic purposes from those principles plus the Retention and Data Integrity Principles, where publication would be in the public interest.

Section 20 lets the Minister, on the Information Commissioner's recommendation, exempt a data user or class of data users from any or all of the Act's principles by Order published in the Gazette. The Act states no commencement date of its own. Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.

The Act received the Governor-General's assent on 28 October 2013 and was published in the Official Gazette (Vol. XXXIII No. 64) on 7 November 2013.

Section 6 requires a data user, on a data subject's request, to disclose the purposes for which their personal data is being or will be collected and processed, any information available about its source, the classes of third parties it may be disclosed to, whether supplying the data is obligatory or voluntary and the consequences of not supplying it, and how to contact the data user with inquiries or complaints.

Section 11 gives a data subject the right to access their personal data held by a data user and to have it corrected where it is inaccurate, incomplete, misleading or not up to date, except where access or correction is refused under this Act.

Section 12 requires a public body or private body, on a person's written request and payment of the prescribed fee, to say whether personal data of which that person is the data subject is being processed and, if so, to communicate the data itself, the purposes of processing, the classes of recipients and the source of the data.

Section 13 requires the body to give written notice within thirty days of the request whether access will be granted and, if so, to give access, subject to an extension of up to thirty further days or a longer period needed to convert the data into an alternative format.

Section 14 lets a body deny access where it lacks information to identify the requester or locate the data, where an exemption or duty of confidentiality applies, where a third party identifiable from the data withholds consent, or where the Information Commissioner approves the refusal in writing, and requires the Chief Executive Officer's refusal notice to state the specific statutory ground and the right to complain to the Information Commissioner.

Section 15 requires the body to let the data subject examine the personal data or give them a copy, in an alternative format where the data subject has a sensory disability and that format already exists or converting to it is reasonable.

Section 16 requires the body, on a data subject's written application specifying the claimed defect and the amendment requested, to correct personal data found to be incomplete, incorrect, misleading, excessive or irrelevant without obliterating the pre-amendment text, or to refuse with written reasons and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days. The Act states no commencement date of its own.

It received the Governor-General's assent on 28 October 2013 and was published in the Official Gazette (Vol. XXXIII No. 64) on 7 November 2013. Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.

Section 21 assigns the Information Commissioner appointed under the Freedom of Information Act 2004 the powers, functions and duties needed to enforce this Act. Section 22 makes it an offence for a person to intentionally disclose another person's personal information in contravention of this Act, or to collect, store or dispose of personal information in a manner that contravenes it.

Section 18(3) separately makes contravening the sensitive personal data conditions in section 18(1) an offence carrying a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both.

Section 23 makes a contravention of this Act for which no other penalty is specified an offence carrying, for an individual, a fine of up to fifty thousand dollars or imprisonment of up to three years on summary conviction, or a fine of up to one hundred thousand dollars or imprisonment of up to five years on conviction on indictment, and for a body corporate, a fine of up to two hundred thousand dollars on summary conviction or five hundred thousand dollars on indictment.

Section 24 gives a right of appeal to the Eastern Caribbean Supreme Court against a requirement in an enforcement notice or an information notice, against a decision of the Information Commissioner on a complaint, or against any decision of the Information Commissioner in the conduct of duties and powers under this Act.

Section 25 bars criminal or civil proceedings against the Information Commissioner, or a person acting on the Commissioner's behalf, for anything done in good faith in exercising a power, duty or function under this Act, and gives absolute privilege to words spoken and reports made in good faith in that exercise.

Section 26 bars the Information Commissioner and anyone acting on the Commissioner's behalf from disclosing information that comes to their knowledge in the conduct of their functions under this Act. Section 27 requires the Information Commissioner to include a report on data protection activities under this Act in the annual report made to Parliament under the Freedom of Information Act 2004. The Act does not arm a data subject with an independent private right of civil action.

The Act states no commencement date of its own. It received the Governor-General's assent on 28 October 2013 and was published in the Official Gazette (Vol. XXXIII No. 64) on 7 November 2013. Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.

Section 18(1) bars a data user from processing sensitive personal data, meaning information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, except where the data subject has given explicit consent to the processing.

Section 18(1)(b) lists the alternative grounds on which sensitive personal data may be processed without consent, including exercising or performing an employment law right or obligation, protecting the vital interests of the data subject or another person where consent cannot be given or reasonably obtained, medical treatment by a healthcare professional or a person under an equivalent duty of confidentiality, legal proceedings or obtaining legal advice, establishing, exercising or defending legal rights, the administration of justice, or exercising a function conferred by written law.

Section 18(1)(c) also permits processing sensitive personal data that the data subject has already made public through their own deliberate action. Section 18(2) lets the Minister, by Order published in the Gazette, exclude some of those grounds in specified cases or make them subject to further conditions. The Act states no commencement date of its own. It received the Governor-General's assent on 28 October 2013 and was published in the Official Gazette (Vol. XXXIII No. 64) on 7 November 2013.

Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.

Section 3(1) prohibits a person from intentionally, without lawful excuse or justification, accessing an electronic system or network, downloading, copying or extracting data or an electronic database from it, introducing a contaminant or malicious code, damaging or disrupting the system, denying an authorised person access to it, or destroying or altering source code with intent to cause damage.

The trigger is the absence of a "lawful excuse or justification" for the access, rather than a requirement to infringe a security measure, so the provision reads on its face more broadly than a statute limited to defeating an access control; a service that publishes a page for open, unauthenticated public access would ordinarily give a visitor a lawful excuse to access and copy it.

The offence carries a fine of up to two hundred thousand dollars or imprisonment of up to three years, or both, on summary conviction, or a fine of up to five hundred thousand dollars or imprisonment of up to seven years, or both, on conviction on indictment. The Act states no commencement date of its own. It received the Governor-General's assent on 28 October 2013 and was published in the Official Gazette (Vol. XXXIII No. 65) on 14 November 2013, and no commencement notice has been located.

Section 15(2) makes a compilation of data or other material, described in the Act as a database, eligible for protection only as a literary work, and only where the selection or arrangement of its contents is the author's own intellectual creation; that protection does not reach the underlying data itself, and the Act creates no separate sui generis database right.

Section 52 lets a person deal fairly with a literary, dramatic, musical or artistic work for the purposes of research or private study without infringing copyright, and section 53 lets a person, once a work has been lawfully disclosed, fairly deal with it for the purposes of criticism or review, or (other than a photograph) for reporting current events, without infringing copyright, so long as it is accompanied by a sufficient acknowledgement.

Section 1(2) leaves the Act's own commencement to a day the Minister appoints by notice published in the Gazette, and no such notice has been located. It received the Governor-General's assent on 18 December 2003.

Paragraph 12(2) of Schedule I to the Act provides that the licensee shall ensure that appropriate mechanisms are in place in respect of the security of digital assets issued to recipients, confidentiality, disclosure of information and connected matters. Paragraph 12(1) of Schedule I requires a licensee to carry out an internal compliance review with respect to the conduct of an Offering.

Section 1(2) of the Act provides that it comes into effect on a day to be appointed by the Minister by Notice published in the official Gazette. The Governor-General assented to the Act on 18 June 2020.

The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. The standard applies to all institutions licensed under the Banking Act. The standard comes into effect on 1 February 2023.

Paragraph 5.2.1 of the standard requires a licensed financial institution to ensure that the necessary security control infrastructure is in place to secure e-banking systems and data from both internal and external threats. Paragraph 5.2.2 of the standard requires a comprehensive security process, inclusive of policies and procedures that address possible internal and external security threats in terms of incident prevention and the appropriate response.

Paragraph 6.4 of the standard requires the security process implemented by the institution to be submitted to the Central Bank. The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act.

The Eastern Caribbean Central Bank issued the Prudential Standard on Technology Risk Management in exercise of the powers conferred on it by section 184 of the Banking Act, 2015. The standard comes into effect on 3 January 2023. The standard says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates, unless IT is not a significant function or alternative measures of equal effect have been taken.

The standard says the Board of an institution is ultimately responsible for effective oversight of all IT and cybersecurity risks, systems and processes. The standard says that any deviation from it must be explained in a separate document, to be made promptly available to the ECCB on request. The standard says an institution that relies heavily on its IT systems for daily operations should establish a cybersecurity policy based on its risk assessment.

Section 184(3) of the Banking Act 2015 of Antigua and Barbuda, inserted by the Banking (Amendment) Act 2025, provides that prudential standards issued by the Central Bank shall have the force of law.

Section 23(1)(b) of the Act requires a compliance officer of a licensed undertaking to notify the Office of National Drug and Money Laundering Control Policy forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that an event to which the section applies has occurred. Section 23(3)(f) of the Act makes a cyber reporting event one of the events to which section 23 applies.

Section 23(2) of the Act requires the compliance officer, within 14 days of that notification, to furnish the Commission with a report in writing setting out all the particulars of the case that are available to him. Section 2(1) of the Act defines a cyber reporting event as any act that results in unauthorized access to, disruption, or misuse of the electronic systems or information stored on such systems of a licensed undertaking.

Section 1(2) of the Act provides that it comes into effect on a day to be appointed by the Minister by Notice published in the official Gazette. The Governor-General assented to the Act on 18 June 2020.

The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. Paragraph 6.4 of the standard requires all incident reports and the response to be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the standard also requires any further update on the incident to be reported to the Central Bank.

Paragraph 5.2.7 of the standard requires formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of e-banking services. Paragraph 5.11.2 of the standard requires an incident response plan to include a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents.

The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act.

The Eastern Caribbean Central Bank issued the Prudential Standard on Technology Risk Management in exercise of the powers conferred on it by section 184 of the Banking Act, 2015. Paragraph 12.8.1 of the standard provides that within 24 hours of becoming aware of a cyber-incident, an institution shall alert the ECCB and its Information Security User Group that a cyber-incident occurred.

Paragraph 12.8.1 of the standard also says the compromised institution should complete the incident report in Appendix I and submit it to the ECCB within 48 hours of the incident. The standard lists among the responsibilities of Senior Management notifying directly the customers whose accounts were potentially or actually compromised within seventy-two hours of the discovery of the incident.

The standard lists among the responsibilities of Senior Management notifying the general public about a cybersecurity incident only after notifying the ECCB. Paragraph 12.8.4 of the standard provides that an institution shall provide an update on the incident to the ECCB at a frequency determined by the ECCB. Paragraph 12.8.5 of the standard provides that following the resolution of the cyber-incident an institution shall conduct a post-incident review and submit it to the ECCB.

Section 184(3) of the Banking Act 2015 of Antigua and Barbuda, inserted by the Banking (Amendment) Act 2025, provides that prudential standards issued by the Central Bank shall have the force of law.

Section 6(9)(a) excludes an idea, concept, method of operation, process, principle, procedure, system, discovery or mere data from copyright protection even where expressed in a work, so a bare fact or item of data is never itself a protected work under Antiguan law.

Section 15(2) makes a compilation of data or other material, described in the Act as a database, eligible for protection only as a literary work, and only where the selection or arrangement of its contents is the author's own intellectual creation; that protection does not reach the underlying data itself, and the Act creates no separate sui generis database right of the kind the European Union's Database Directive provides.

Section 52 lets a person deal fairly with a literary, dramatic, musical or artistic work for the purposes of research or private study without infringing copyright, and section 53 separately lets a person, once a work has been lawfully disclosed, fairly deal with it for the purposes of criticism or review of that or another work, or (other than a photograph) for the purpose of reporting current events, without infringing copyright, so long as it is accompanied by a sufficient acknowledgement; no acknowledgement is required where current events are reported by sound recording, film, broadcast or cable programme.

Section 54 directs a court assessing fair dealing to weigh the nature of the work, the extent and substantiality of the part used relative to the whole, the purpose and character of the use, and the effect of the use on the work's potential market or commercial value. Section 1(2) leaves the Act's own commencement to a day the Minister appoints by notice published in the Gazette, and no such notice has been located. It received the Governor-General's assent on 18 December 2003.