Guyana

Section 65(1) requires the data controller, where there is a personal data breach, to notify the Commissioner without undue delay and, where feasible, not later than seventy-two hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of any person. Section 65(2) requires a notification made after seventy-two hours to give reasons for the delay.

Section 65(3) requires a data processor to notify the data controller without undue delay after becoming aware of a breach. Section 65(4) lists what the notification describes, including the nature of the breach, the likely consequences and the measures taken. Section 65(6) requires the controller to document every breach.

Section 66(1) requires the controller to communicate a breach likely to result in a high risk to the rights and freedoms of persons to the data subject without undue delay and, where feasible, not later than seventy-two hours after becoming aware of it. Section 66(3) lifts that duty in three cases, including where encryption made the data unintelligible.

Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on 16 August 2023 following passage on 9 August 2023. No commencement order has been located.

Section 3(1) applies the Act to a data controller or data processor established in Guyana, and to one not established there that uses equipment in Guyana for processing or whose processing relates to offering goods or services to data subjects in Guyana or monitoring their behavior there.

Section 4(1) requires personal data to be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, kept adequate, accurate and no longer than necessary, and processed with appropriate security. Section 4(2) makes the data controller answerable for complying with all of it.

Section 6(1) makes processing lawful only on a listed basis, beginning with the data subject's consent for one or more specific purposes and running through contract, legal obligation, vital interests, public functions and legitimate interests. Section 7 requires the controller to be able to demonstrate consent and to inform the data subject of the right to withdraw it.

Section 51(1) bars a person from operating as a data controller unless registered in the Register of Data Controllers, section 51(3) requires a controller not established in Guyana to nominate a representative established there. Section 57 imposes the same registration rule on data processors.

Section 62 requires a record of processing activities, section 64 requires appropriate technical and organizational security measures, section 67 requires an impact assessment before processing likely to result in a high risk. Section 69 requires a data protection officer in the cases it lists. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions.

The National Assembly gazetted the Data Protection Act 2023 as Act No. 18 of 2023 on 16 August 2023, following passage on 9 August 2023. As of the date below, no commencement order under the Act has been located, and a report of 1 April 2026 states that the requisite commencement order has not been issued. Guyana's Digital Identity Card Act 2023 came into operation before the Data Protection Act was commenced.

The Digital Identity Card Act's Commissioner and safeguard duties are created by the Data Protection Act, so commentators quoted in that report flagged them as unenforceable while the Data Protection Act was not in force.

Section 23 bars the transfer of personal data to a country, territory or international organization outside Guyana unless it provides an adequate level of protection and appropriate safeguards under which the data subject's rights are enforceable and effective legal remedies are available. Section 24 makes adequacy a question of all the circumstances of the case, including the nature of the data, the destination, the law in force there and the supervisory authorities.

Section 25 lists the appropriate safeguards, including binding corporate rules, standard data protection clauses prescribed by the Commissioner with the Minister's approval, and contractual clauses authorized by the Commissioner. Section 26 requires binding corporate rules to be submitted to the Commissioner for authorization.

Section 27 allows a foreign court judgment or administrative decision requiring a transfer or disclosure to be recognized or enforced only if based on an international agreement with Guyana. Section 28 lets a transfer proceed without sections 23 to 25 on listed grounds such as the data subject's consent. Section 29 makes contravening sections 23, 24 or 25 an offence.

Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on 16 August 2023 following passage on 9 August 2023. No commencement order has been located.

Section 19(1) gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects the data subject. Section 19(2) disapplies the right where the processing is necessary for a contract, authorized by a law that lays down suitable safeguards, or based on the data subject's consent.

Section 19(3) requires the controller to implement suitable safeguards in the contract and consent cases. Section 19(4) withdraws those exceptions for sensitive personal data unless it is in the public interest and suitable safeguards are in place. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on 16 August 2023 following passage on 9 August 2023. No commencement order has been located.

Section 11 gives a data subject the right to be told whether a data controller processes the data subject's personal data, to be given a description of the purposes, categories, recipients, retention period and source, and to be given a copy. Sections 12 and 13 give rights to rectification and erasure. Section 13(2) lists the grounds on which the controller shall erase personal data without undue delay, including withdrawal of consent.

Section 14 gives a right to restriction of processing and section 15 requires the controller to tell each recipient of a rectification, erasure or restriction. Section 16 gives a right to receive personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller. Section 17 gives a right to object, including to processing for direct marketing.

Section 18 lets a data subject require a controller in writing to cease or not begin processing that is causing or likely to cause substantial and unwarranted damage or distress. Sections 20 and 21 require the controller to give the data subject the information they list, at collection or, where the data came from another source, within a reasonable period and at the latest within one month.

Section 22 requires a response without undue delay and in any event within one month of receipt of the request, extendable by two months for complex or numerous requests, free of charge. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on 16 August 2023 following passage on 9 August 2023. No commencement order has been located.

Section 72 provides that the President appoints a Data Protection Commissioner. Section 73 makes monitoring and enforcing the application of the Act the Commissioner's first function. Section 78 lets the Commissioner serve an enforcement notice on a data controller or data processor that has contravened the Act.

Section 85 makes failing to comply with an enforcement, information or special information notice an offence liable on summary conviction to a fine of one million dollars or imprisonment for three months.

Section 4(10) makes failing to comply with the section 4(1) principles an offence, liable on summary conviction to a fine of five million to fifty million dollars or imprisonment for up to two years, and on indictment to a fine of twenty million to one hundred million dollars or imprisonment for up to five years. Section 97 entitles a person who suffers damage or distress from a contravention to compensation from the controller or processor.

Section 99 lets the Commissioner, after a hearing, order an administrative penalty of up to ten million dollars for contravening sections 53(1), 59(1) and 62 to 69. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on 16 August 2023 following passage on 9 August 2023. No commencement order has been located.

Section 9(1) prohibits the processing of sensitive personal data unless one of the listed grounds applies, the first being the data subject's consent. Section 2 defines sensitive personal data to include genetic data, biometric data, health records, financial records, criminal records, racial or ethnic origin, political opinions, religious beliefs, trade-union membership and sexual orientation or sexual life.

Section 9(2) lets the Minister specify by order further circumstances in which sensitive personal data may be processed. Section 8(1) makes the processing of a child's personal data lawful only where and to the extent that the child's parent or guardian gives or authorizes consent. Section 8(2) requires the controller to make reasonable efforts to verify that consent, taking available technology into account.

Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on 16 August 2023 following passage on 9 August 2023. No commencement order has been located.

The Cybercrime Act 2018 (Act No. 16 of 2018) was gazetted 13 August 2018, passed by the National Assembly 20 July 2018. Illegal access to a computer system, illegal interception, illegal data interference, illegal acquisition of data, illegal system interference, and illegal devices are all offences under the Act.

The Act also creates an offence for child pornography distributed through a computer system, and separately an offence for publishing or transmitting an intimate image of a person without that person's consent. The specific section number, the exact statutory wording, and a confirmed penalty figure for the illegal-access offence itself are not stated here.

A secondary account describes the offences generally as carrying penalties ranging from months to years of imprisonment and substantial fines, without stating the illegal-access offence's own figure. The date recorded as the Act's effective date is its Gazette publication date; no separate commencement clause was located in the sources read, though public reporting of charges and convictions under the Act since 2020 confirms it is in force.

Paragraph 6 of the Guideline applies it, as appropriate, to all licensed financial institutions. Paragraph 9 of the Guideline describes the supervisory approach as not a prescriptive and comprehensive approach for all technology risks. Paragraph 25 of the Guideline requires an institution's technology risk management framework to be able to identify the information system assets that need protection and the direct and indirect IT threats.

Paragraph 76 of the Guideline requires a financial institution to implement an appropriate access controls policy for the identification, authentication and authorization of internal and external users. Paragraph 102 of the Guideline requires a financial institution to ensure that the scope, frequency and intensity of technology audits are commensurate with the complexity, sophistication and criticality of its technology systems and applications.

Paragraph 107 of the Guideline requires a licensed financial institution to notify the Bank before conducting e-banking or any other internet services, including introducing new technology relating to them. Paragraph 116 of the Guideline provides that, where an institution has failed to comply, the Bank may issue specific directives to it and impose any or all of the corrective actions under the Financial Institutions Act.

Footnote 10 of the Guideline states that the incident management reporting template in Appendix 3 can also be used to report incidents to the Bank. No commencement notice for the provisions this entry describes has been located.

Section 6 of the Copyright Act 1956 (UK) permits, without the copyright owner's consent, fair dealing with a literary, dramatic, or musical work for the purpose of reporting current events in a newspaper, magazine, or similar periodical, provided the use is accompanied by a sufficient acknowledgment. The same section separately permits fair dealing for research, private study, criticism, or review.

Section 9 extends the same fair-dealing structure to artistic works for research, private study, criticism, or review. The section carries no headline-length or short-extract cap distinct from the fair-dealing test, and no reported Guyanese decision applies it to a systematic news aggregator rather than an individual quoting or reporting on a published work.

Guyana has no dedicated press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates; the 1966 Order extending the 1956 Act to British Guiana modifies other named sections and schedules of the Act for local application but the located text does not show section 6 or section 9 among the sections it modifies.