Trinidad and Tobago

Section 69 of the Data Protection Act, Chap. 22:04 is the clause that reaches companies with no office in the country. It sits in Part IV, which covers the private sector. Part IV has never been brought into force. Only these parts are in force. Part I, and sections 7 to 18, 22, 23, 25(1), 26 and 28, from 6 January 2012 under Legal Notice 2 of 2012. Also section 42(a) and (b), from 23 August 2021 under Legal Notice 220 of 2021. Section 6 sits in Part I, so it is in force. It says the General Privacy Principles apply to everyone who handles, stores or uses personal information belonging to another person. That is a very wide reach. Nothing sits behind it, because Parts III, IV and V are all switched off. Financial firms face one real location rule. An electronic money issuer must be a company with its registered office in Trinidad and Tobago.

Industry by industry. BANKING, INSURANCE AND PAYMENTS: data can leave only if conditions are met The Central Bank's Guideline for the Management of Outsourcing Risks (February 2022) applies to regulated financial firms. It tells them to use service providers only in certain countries. The country's data protection and privacy law, regulation or supervision must be equal to Trinidad and Tobago's, or better. You must get customer consent before sending customer information to a service provider. You must also tell the Central Bank if a foreign authority asks for access to customer data. GOVERNMENT AND PUBLIC BODIES: data must stay in the country on paper, but not in force. Section 36 of the Data Protection Act would make a public body store personal information only in Trinidad and Tobago. It could also be reached only from Trinidad and Tobago. There are two exceptions. The person consents in the way the law sets out, or the destination has comparable safeguards. 'Public body' covers ministries, municipal corporations, service commissions, the Tobago House of Assembly and state-owned companies. Section 36 sits in Part III, which has never been brought into force. GAMBLING: data must stay in the country on paper, not in force. Schedule 3 to the Gambling (Gaming and Betting) Control Act, 2021 sets a licence condition. You must keep all books, records and documents about the licensed activity at the licensed premises. They must be kept at least seven years. Only Parts I, II and X and Schedule 1 started, on 11 August 2021. Part III covers licensing and carries Schedule 3. It is not in force. TELECOMS: data can leave only if conditions are met in substance. A concession holder must keep user information confidential. It may use that information only to run the network, to bill, to protect its property, and for a few other listed purposes. It must also be able to give prompt help with interception warrants. That normally means keeping the technical ability inside the country. BORDER AND TRAVEL: data can leave only if conditions are met The law is passed but not in force. HEALTH, EDUCATION, SECURITIES, DEFENCE AND MAPPING: we found no rule about sending data abroad. Checked 19 August 2026, confidence medium.

Section 28 of the Data Protection Act is in force. It requires the Information Commissioner to publish a list of countries with comparable safeguards for personal information. The list must appear in the Gazette and in two daily newspapers. No such list has ever been published, because no Commissioner has been appointed. The list is empty, and right now nobody can add to it. So a rule that allows only approved countries behaves like no rule at all. For public bodies, section 46 would set up a case-by-case route. The body would have to tell the person, get consent, and send doubtful destinations to the Commissioner to decide whether safeguards are comparable. Section 46 is not in force. For Central Bank licensees, four things actually matter. The equivalence test in the outsourcing guideline. Customer consent under paragraph 5.7.3. Contract terms that keep the Central Bank's access to books and records. And a duty to tell the Central Bank if any overseas authority asks for access to customer information. Existing major outsourcing contracts had to be reported to the Inspector of Financial Institutions within six months of the guideline being issued.

Sections 7 to 18 of the Data Protection Act came into force on 6 January 2012. They set up the Office and provide for appointing the Commissioner, the Deputy and staff. Other sections were never started and are still not in force as at 19 August 2026. Section 19 covers inspectors and their powers. Sections 20 and 21 cover audits and enquiries. Section 24 covers privileged information. Section 27 covers the annual report to Parliament. All of Parts III, IV and V are switched off too. A Senate motion asked the Government to bring the remaining sections into force. It was debated on 31 January, 28 February and 28 March 2023 and passed as amended. No proclamation followed. We reviewed the official register of Legal Notices for 2022, 2023, 2024, 2025 and 2026. We found no further proclamation of any part of the Data Protection Act. The office has no website and does not appear in the national government services directory. Enforcement rating: dormant. Other regulators are active. The Central Bank of Trinidad and Tobago issues circulars and requires annual cybersecurity self-assessments. The Trinidad and Tobago Securities and Exchange Commission publishes administrative sanctions orders. The Telecommunications Authority publishes current market statistics and decisions. The national cyber incident response team publishes incident statistics, updated to 23 July 2026. None of these is a privacy regulator.

MINIMUM KEEP TIMES. Money laundering: six years. That covers all local and international transactions, customer identity checks, account files, business correspondence, and the results of analysis of an account transaction. Securities: section 87(4) of the Securities Act, Chap. 83:02 requires any book, record or document kept under that Act to be kept for at least six years. Electronic money: clause 22 of the E-Money Issuer Order, 2020 requires record systems that keep customer and transaction files for a minimum of seven years. Gambling: seven years from the end of the transaction the records relate to, at the licensed premises, once Part III starts. Passenger data: seven years under the Advance Passenger Information and Passenger Name Record Act, 2026, once it starts. Booking record data must have identifying details stripped out after six months. MAXIMUM KEEP TIME. Principle (e) of section 6 of the Data Protection Act is in force. It says personal information 'shall only be retained for as long as is necessary for the purpose collected'. There is no regulator, no penalty in force and no published guidance. So this limit is not enforced. CONFLICT. Trinidad and Tobago's laws have no express conflict rule. The specific minimum keep times can be enforced and the general privacy limit cannot. So the minimum keep time wins.

DEADLINE 1: Central Bank, 24 hours. The Cybersecurity Best Practices Guideline (September 2023) was issued under section 10(b) of the Financial Institutions Act, 2008 and section 278(1) of the Insurance Act, 2018. It says you must alert the Central Bank as soon as possible. The limit is 24 hours from becoming aware of a cyber incident. DEADLINE 2: Central Bank, 72 hours. You must send the Cyber Incident Reporting Template within 72 hours of the incident. Then you send regular updates, for example daily, until it is resolved. You also do a post-incident review. If you fail to report, the Central Bank may impose extra supervisory reporting or compliance directions. The outsourcing guideline adds a separate duty. You must tell the Central Bank about any unauthorised access or breach of confidentiality by a service provider or sub-contractor. DEADLINE 3: none for everyone else. The Data Protection Act has no breach reporting rule at all, in force or otherwise. The Trinidad and Tobago Cyber Security Incident Response Team runs a reporting portal and publishes incident statistics, last updated 23 July 2026. We found no law that makes a report to it compulsory. FUTURE DEADLINE. The Advance Passenger Information and Passenger Name Record Act, 2026 covers high-risk personal data breaches. You must tell the person affected and a Data Protection Officer without undue delay. That Act is not yet in force.

TRAP 1: the law reads as binding but is not. Read the Data Protection Act and you find detailed duties on public bodies, private companies, directors and officers. Parts III, IV and V have never been brought into force. A compliance programme built from the statute text alone rests on sections that do not operate. TRAP 2: the Electronic Transactions Act, Chap. 22:05 is also only partly in force. Parts I to IV and Part VII started in January 2012. Part V covers electronic authentication service providers. Part VI covers liability of intermediaries and telecoms service providers. Part VIII covers consumer protection and unwanted commercial messages. Part IX covers offences. Parts V, VI, VIII, IX and X have not started. So there is no anti-spam rule in force, and no legal shelter in force for online intermediaries. TRAP 3: forced collection plus a gag. Section 18 of the Interception of Communications Act, Chap. 15:08 lets an authorised officer with a warrant demand communications data from a telecoms provider. If the provider does not already hold the data, it can be required 'to obtain the data and so disclose it'. The provider must not tell anyone the notice exists, except its own staff and its lawyers. Section 13 makes it an offence to fail to give prompt interception help. The fine is one million Trinidad and Tobago dollars, roughly one hundred and fifty thousand United States dollars. TRAP 4: emergency powers. Emergency Powers Regulations were made under section 7 of the Constitution and published on 3 March 2026. They let the Minister responsible for internal security make Orders 'authorising the interrogation of computers and electronic devices seized'. Detention orders under those Regulations were still being gazetted through 2026. TRAP 5: the sleeping penalty is unusually harsh. Section 95 of the Data Protection Act allows prison of up to five years on indictment. Section 96 lets a court fine a company up to ten per cent of the annual turnover of the enterprise. Directors and officers who directed or agreed to an offence commit the offence themselves. None of Part V is in force. So this risk could appear overnight rather than existing today.

COMING. The Advance Passenger Information and Passenger Name Record Act, 2026 (Act No. 7 of 2026) was signed on 15 May 2026 and gazetted on 21 May 2026. Its section 2 says it starts on a date the President fixes by Proclamation. Parliament's own bill tracker records its status as 'Assent: Awaiting Proclamation'. It repeals and replaces the Immigration (Advance Passenger Information) Act. It also puts the CARICOM Advance Passenger Information System into operation. NOT COMING, so far. We checked Parliament's bills index on 19 August 2026. No Data Protection (Amendment) Bill has been introduced. In January 2023 the responsible minister told the Senate that updates were being developed with international consultants and Inter-American Development Bank support. More than three years later, no bill has been laid. SWITCHES THAT COULD BE FLIPPED. First and largest: section 1(2) of the Data Protection Act lets the President bring any remaining section into force on any chosen day, by Proclamation. That single act would switch on section 36, which keeps public sector data stored and reachable only in Trinidad and Tobago. It would also switch on all private sector duties in Part IV, and the prison and turnover-percentage penalties in Part V. Second: section 100 lets the Minister make Regulations under the Act. Third: section 71 lets the Information Commissioner, once appointed, order any industry to write a compulsory code of conduct. Section 74 makes such a code binding. Fourth: Part III of the Gambling (Gaming and Betting) Control Act, 2021 can start at any time. That would switch on the licence condition to keep records on the premises. Fifth: Emergency Powers Regulations can be revived or amended during a state of public emergency. None of these needs consultation.