The British Virgin Island’s (BVI’s) Data Protection Act 2021 came into force on 9 July.

The law aims to meet UK and EU standards of data protection, as established by the EU’s General Data Protection Regulation (GDPR). Until now, there has been no specific data protection legislation in the BVI, although the current Computer Misuse and Cybercrime Act 2014 does restrict the publication of illegally obtained confidential data. Common law duties of privacy and confidentiality also exist.

All BVI-incorporated companies and limited partnerships with legal personality are within scope of the law. Limited partnerships without legal personality may also be in scope ‘by virtue of being established in the BVI,’ says law firm Mourant.

As well as the usual constraints on holding, disclosing and processing data, data controllers must also undertake certain other duties. These include informing a data subject of the purposes for processing, the source of the personal data, the rights to request access to and correction of personal data, the class of third parties to whom the personal data will be disclosed, whether the data subject is obliged to supply the personal data and the consequences of non-compliance.

Data controllers must also take practical steps to protect personal data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. They must not transfer personal data outside of the BVI unless there are adequate safeguards in the destination jurisdiction or unless the data subject consents.

For regulated entities in the BVI that have to process personal data as part of their onboarding processes and anti-money laundering obligations, ‘this will capture the persons engaged to process such on-boarding,’ says law firm Ogier. It also notes that the law will apply ‘if the process of personal data is engaged on behalf of a person established in the BVI, or is not for a person established in the BVI but is processed in the BVI’...