Trinidad and Tobago

Section 1(2) brought Part I into force on 6 January 2012, together with sections 7 to 18, 22, 23, 25(1), 26 and 28 of Part II, while Part III, Part IV and Part V remain enacted but not proclaimed. Section 3 binds the State, and section 4 states the Act's object as protecting an individual's right to privacy and the right to keep sensitive personal information private and personal.

Section 5 keeps the Act from limiting information a party may obtain by law in a proceeding, a Court's power to compel testimony or production, or a judicial officer's own working notes. Section 6 states the General Privacy Principles, applicable to all persons who handle, store or process personal information belonging to another person, independent of whether Part III or Part IV has been brought into force for the body or organisation concerned.

Those Principles make an organisation responsible for the personal information under its control, require it to identify the collection purpose before or at collection, require the individual's knowledge and consent for collection, use or disclosure, limit collection to what is legally undertaken and necessary, limit retention and further disclosure to the purpose of collection, require the information to be accurate, complete and up to date, require appropriate safeguards, require organisations to make their information-handling policies available to individuals, and give the individual a right to challenge an organisation's compliance and receive a timely response.

Two further Principles are researched separately as their own families: paragraph (h) restricts processing sensitive personal information and paragraph (l) restricts disclosing personal information outside Trinidad and Tobago.

Section 6(l) of the General Privacy Principles already requires that personal information requested to be disclosed outside of Trinidad and Tobago be regulated, and that comparable safeguards to those under this Act exist in the receiving jurisdiction, binding every person who handles personal information regardless of whether Part III or Part IV has been proclaimed.

Section 46 would require a public body disclosing personal information to a party in another jurisdiction to tell the individual the purpose of the disclosure and the identity of the requester and the receiving jurisdiction's data protection body, and to obtain consent; where the individual withholds consent the public body would not disclose, and where the receiving jurisdiction's safeguards are in doubt the public body would refer the question to the Commissioner for a determination.

Section 72 would impose the equivalent duty on an organisation disclosing personal information under a mandatory code of conduct, again with a Commissioner referral where the organisation is not satisfied the receiving jurisdiction has comparable safeguards.

Section 28 already lets the Commissioner publish a list of countries the Commissioner considers to have comparable safeguards for personal information, which operationalises the section 6(l) principle even before sections 46 and 72 take effect.

Sections 46 and 72 are not shown as commenced: they sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on 6 January 2012, so the detailed consent-and-referral mechanism awaits proclamation while the general section 6(l) principle already binds.

Part III, sections 52 to 59, would give every individual in Trinidad and Tobago a right of access to personal information about them held in a public body's personal information bank or otherwise under its custody or control, require the Head of a Public Body to respond within thirty days, and let an individual appeal a refusal to the Commissioner within six weeks.

Section 53 would let the Head of a Public Body refuse access where disclosure would invade another individual's privacy, reveal information supplied in confidence, reveal a confidential source of evaluative material, or fall within a Freedom of Information Act exemption, and section 68 would put the burden of proving an exemption applies on the public body.

Section 57 would give an individual a right to request correction of an error or omission, require the Head of a Public Body to annotate an unactioned correction request, and require notice of a correction to any other public body or third party the information was disclosed to in the year before the request.

Part IV, sections 75 to 85, would give the equivalent access right against an organisation subject to a mandatory code of conduct, with the same Commissioner review and complaint process, but no equivalent correction right of its own; an organisation covered by a mandatory code would instead comply with the code's own provisions.

None of Part III or Part IV is shown as commenced: section 1(2) brought only Part I and specified sections of Part II into force on 6 January 2012, so an individual currently has no statutory access or correction right against either a public body or a private organisation under this Act. No proclamation appointing the day these provisions come into force has been located.

Sections 7 to 18 establish the Office of the Information Commissioner as a body corporate, provide for the appointment, tenure, removal, remuneration and oath of the Commissioner and up to two Deputy Commissioners, and give the Commissioner powers to audit and investigate compliance, order a public body or organisation to cease a contravening practice, authorise data matching, make orders on fee reasonableness and compliance with the General Privacy Principles, and publish compliance guidelines.

Section 10 gives the Commissioner functions including promoting codes of conduct, disseminating information about the Act, monitoring compliance, cooperating with counterparts in other jurisdictions, researching privacy issues, flagging a body's failure to meet the Principles or Part III or Part IV, publishing compliance reports, and reviewing privacy impact assessments.

Section 25(1) bars the Commissioner and anyone acting under the Commissioner's direction from disclosing information obtained in performing their duties, and section 28 requires the Commissioner to publish a list of countries with comparable safeguards for personal information.

All of these provisions, together with the rest of Part I, came into force on 6 January 2012, so Trinidad and Tobago currently has an operating Information Commissioner with these powers and functions, even though the Parts the Commissioner would chiefly enforce, Part III and Part IV, are not yet proclaimed.

Not commenced within Part II are the designation of inspectors (section 19), the Commissioner's power to audit or enquire pursuant to Part III (section 20) or Part IV (section 21), privileged information (section 24), the exceptions to the Commissioner's confidentiality obligation (section 25(2) and (3)), and the Commissioner's annual report to Parliament (section 27).

Part V, sections 87 to 96, would make it an offence to obstruct the Commissioner, make a false statement, fail to comply with a Commissioner order, violate the whistle-blowing protection, breach a mandatory code of conduct, wilfully disclose or unlawfully collect personal information in contravention of the Act, or breach the Commissioner's own confidentiality obligation under section 25, and would penalise an individual offender with a fine of up to $100,000 or five years' imprisonment on indictment and a body corporate with a fine of up to $500,000 on indictment or up to ten percent of annual turnover.

Part V is not shown as commenced: section 1(2) does not name it among the provisions brought into force on 6 January 2012, so none of the Act's offences or penalties currently apply, and a contravention of the General Privacy Principles, including the confidentiality obligation in section 25(1) that already binds the Commissioner's own office, cannot presently be prosecuted under this Act.

Section 86, in Part IV, would require every director and officer of a corporation to take reasonable care to ensure that the corporation complies with the Act, the Regulations and any Order of the Commissioner. Section 86 is not among the provisions that section 1(2) names as having come into operation on 6 January 2012.

Section 6(h) of the General Privacy Principles states that sensitive personal information is protected from processing except where otherwise provided for by written law, and this principle binds every person who handles, stores or processes personal information regardless of whether Part III or Part IV has been proclaimed.

Sensitive personal information is defined as information on a person's racial or ethnic origins, political affiliations or trade union membership, religious or similar beliefs, physical or mental health or condition, sexual orientation or sexual life, or criminal or financial record.

Section 40 would limit a public body's processing of sensitive personal information to cases where it has the person's consent, or the information is processed by a health care professional for preventive medicine, diagnosis, treatment or hospital care management, has already been made public by the person, is processed for research under section 43, serves law enforcement or national security, determines access to social services, or another written law authorises it.

Section 76 states the equivalent limitation for a corporation, in materially the same terms as section 40 except that it does not include a law-enforcement-or-national-security ground.

Neither section 40 nor section 76 is shown as commenced: both sit in Part III and Part IV, which section 1(2) does not name among the provisions brought into force on 6 January 2012, so the detailed conditions for processing sensitive personal information await proclamation while the general prohibition in section 6(h) already binds.

Section 3(1) prohibits knowingly and without authority causing a computer to perform any function for the purpose of securing access to a program or data held in that computer or another one, on pain of a fine of $15,000 and imprisonment for two years, rising to $30,000 and four years on a second or subsequent conviction.

Section 2(2) defines access as unauthorised where the person is not entitled to control access of that kind and does not have the consent of the person who is; the offence does not require infringing a security measure, so it is drawn more broadly than a computer-misuse statute that turns on circumvention.

Section 3(2) adds a further fine and imprisonment where the access causes damage, and section 9 enhances the penalty to $150,000 and ten years' imprisonment where the offence involves a protected computer. No reported Trinidadian case construes whether reading a public, unauthenticated page without defeating any access control falls within the section absent the consent element being read narrowly.

Section 6(1)(b) protects, as a derivative work, a collection of works and a collection of mere data (a database), in machine-readable or other form, provided the collection is original by reason of the selection, coordination, or arrangement of its contents.

This is ordinary compilation copyright rather than a sui generis database right of the kind the European Union grants, so a database that is not original in its selection or arrangement receives no protection under this section regardless of the effort spent assembling it, and copying an unoriginal collection of data is not an infringement under this provision.

The Act predates the text-and-data-mining exception found in some newer copyright statutes, so no machine-readable opt-out mechanism or text and data mining (TDM)-specific exception exists for a protected collection.

The Central Bank of Trinidad and Tobago's Cybersecurity Best Practices Guideline says it is established in accordance with section 10(b) of the Financial Institutions Act, 2008 and section 278(1) of the Insurance Act, 2018 in respect of companies authorized under those Acts. The Guideline says other institutions not regulated by the Central Bank are encouraged to adopt its provisions but are not required to report to the Central Bank.

The Guideline says a formal risk-based cybersecurity strategy should be developed covering identification, protection, detection, response and recovery. The Guideline says the Board should approve the cybersecurity strategy and be kept informed of developments at least annually. The Guideline says regular and appropriate cybersecurity training must be provided to employees and customers in an understandable way.

The Central Bank's circular letter issuing the final Guideline says financial institutions must conduct an annual self-assessment against the Guideline and submit the Return to the Central Bank by March 31 of the next calendar year. Section 10 of the Financial Institutions Act, 2008 lets the Central Bank issue guidelines on any matter it considers necessary to enable the Central Bank to meet its objectives.

Section 12 of the Financial Institutions Act, 2008 says contravention of a guideline referred to in section 10 is not an offence but does not prevent the Central Bank or the Inspector from taking action under section 86. Section 86 of the Financial Institutions Act, 2008 lets the Inspector direct a licensee that has failed to comply with a measure imposed by the Central Bank to cease or refrain from the conduct or to perform the acts needed to remedy the situation.

The Central Bank of Trinidad and Tobago's Cybersecurity Best Practices Guideline says it is established in accordance with section 10(b) of the Financial Institutions Act, 2008 and section 278(1) of the Insurance Act, 2018 in respect of companies authorized under those Acts. Appendix II of the Guideline says all companies are required to provide timely notification to the Central Bank when material incidents relating to their operations occur.

Appendix II of the Guideline says that, as soon as possible but within 24 hours of becoming aware of a cyber-incident, the company shall alert the Central Bank that a cyber-incident has occurred. Appendix II of the Guideline says the company should complete the Cyber Incident Reporting Template and submit it to the Central Bank within 72 hours of the incident.

Circular Letter CB-OIFI-399/2025 of February 5, 2025 tells regulated financial institutions of the requirement to report any cybersecurity incidents within twenty-four (24) hours of becoming aware of them. The same circular letter sets an initial notification within 24 hours of becoming aware of a cyber-incident and complete cyber incident reporting within 72 hours of the incident.

Section 12 of the Financial Institutions Act, 2008 says contravention of a guideline referred to in section 10 is not an offence but does not prevent the Central Bank or the Inspector from taking action under section 86. Section 86 of the Financial Institutions Act, 2008 lets the Inspector direct a licensee that has failed to comply with a measure imposed by the Central Bank to cease or refrain from the conduct or to perform the acts needed to remedy the situation.

The Virtual Assets and Virtual Asset Service Providers Act, 2025 establishes a Regulatory Sandbox into which virtual asset service providers that were operating before the Act's commencement may be authorised to conduct certain virtual asset activities under certain conditions. The Act defines a Sandbox Participant as a company that has been issued and holds a valid certificate of acceptance under the Act.

Section 10(3) of the Act requires a Sandbox Participant to notify the Commission in writing within ten days of becoming aware that a cyber-security event has occurred. Section 10(4) of the Act requires the Sandbox Participant to furnish the Commission with a written report setting out the particulars of the situation within seven business days of providing the notification.

Section 5(3) of the Act lets the Commission issue warning letters, compliance directions, suspensions and terminations and impose administrative fines for failure to comply with conditions attached to participation in the Regulatory Sandbox. The Trinidad and Tobago Securities and Exchange Commission states that the Act was assented to on December 23, 2025 and took effect upon assent.

Section 10(1) permits, without the copyright owner's authorization, the reproduction of a short part of a published work in the form of a quotation, provided the reproduction is compatible with fair dealing and does not exceed the extent justified by the purpose. Section 10(2) conditions this on the quotation being accompanied by an indication of its source and the name of the author, if the author's name appears in the work quoted.

The provision carries no headline-length or short-extract cap distinct from the fair-dealing test. No reported Trinidadian decision applies it to a systematic news aggregator rather than an individual quoting a published work, and no separate case law on the point has been located. Neighbouring rights under the Act protect performers and their fixations, not a print or online news publisher's own reporting.