Trinidad and Tobago

The extraterritorial hook is section 69 of the Data Protection Act, Chap. 22:04, sitting in Part IV (private sector). Part IV has never been proclaimed. The only provisions in force are Part I and sections 7 to 18, 22, 23, 25(1), 26 and 28 (from 6 January 2012, Legal Notice 2 of 2012) plus section 42(a) and (b) (from 23 August 2021, Legal Notice 220 of 2021). Section 6, which is in Part I and therefore in force, states that the General Privacy Principles are 'applicable to all persons who handle, store or process personal information belonging to another person' — a broad reach with no enforcement machinery behind it, because Parts III, IV and V are all dormant. Financial institutions face a separate, real localisation-adjacent hook: an electronic money issuer must be a body corporate with its registered office in Trinidad and Tobago.

SECTOR OVERRIDES. Banking, insurance and payments: data can leave with paperwork. The Central Bank's Guideline for the Management of Outsourcing Risks (February 2022) tells regulated financial institutions to 'in principle, enter into arrangements only with service providers operating in jurisdictions with an equivalent (or higher) standard of data protection and privacy legislation, regulation or supervision as exists in Trinidad and Tobago', to obtain customer consent before transferring customer information to a service provider, and to notify the Central Bank if a foreign authority seeks access to customer data. Government and public bodies: data must stay in the country on paper, but not in force. Section 36 of the Data Protection Act would require a public body to store personal information only in Trinidad and Tobago and to allow access only from Trinidad and Tobago, unless the individual consents in the prescribed manner or the destination has comparable safeguards. 'Public body' includes ministries, municipal corporations, service commissions, the Tobago House of Assembly and state-owned companies. Section 36 sits in Part III and has never been proclaimed. Gambling: data must stay in the country on paper, not in force. Schedule 3 to the Gambling (Gaming and Betting) Control Act, 2021 makes it a licence condition that all books, records and documents relating to the licensed activity are 'kept at the licensed premises' and retained at least seven years. Only Parts I, II and X and Schedule 1 were proclaimed, on 11 August 2021; the licensing Part III, which carries Schedule 3, is not in force. Telecoms: data can leave with paperwork in substance. A concession holder must keep user information confidential and may use it only to run the network, bill, protect its property and a few other listed purposes; and it must be able to give prompt help with interception warrants, which in practice means keeping the capability inside the country. Border and travel: data can leave with paperwork, enacted but not in force. Health, education, securities, defence and mapping: no cross-border storage rule found, checked 19 August 2026, confidence medium.

Section 28 of the Data Protection Act requires the Information Commissioner to publish, in the Gazette and in two daily newspapers, 'a list of countries which have comparable safeguards for personal information as provided by this Act'. Section 28 is in force. No such list has ever been published, because no Commissioner has been appointed. The list is therefore empty and, unusually, cannot currently be populated by anyone. This is an allowlist model that behaves like an unrestricted one. For public bodies, section 46 would set up a case-by-case route where the body must inform the individual, obtain consent, and refer doubtful destinations to the Commissioner for a comparable-safeguards determination — section 46 is not in force. For Central Bank licensees the mechanisms that actually matter are the outsourcing guideline's equivalence test, customer consent under paragraph 5.7.3, contract terms preserving the Central Bank's access to books and records, and a duty to notify the Central Bank if any overseas authority seeks access to customer information. Existing material outsourcing contracts had to be notified to the Inspector of Financial Institutions within six months of the guideline's issuance.

Sections 7 to 18 of the Data Protection Act — establishing the Office, providing for appointment of the Commissioner and Deputy, and for staff — were proclaimed on 6 January 2012. Section 19 (inspectors and their powers), section 20 and 21 (audits and enquiries), section 24 (privileged information), section 27 (annual report to Parliament), and all of Parts III, IV and V were not proclaimed and remain unproclaimed as at 19 August 2026. A Senate motion calling on the Government to proclaim the remaining sections was debated on 31 January, 28 February and 28 March 2023 and passed as amended; no proclamation followed. We reviewed the official register of Legal Notices for 2022, 2023, 2024, 2025 and 2026 and found no further proclamation of any part of the Data Protection Act. The office has no website and does not appear in the national government services directory. Enforcement rating: dormant. By contrast the Central Bank of Trinidad and Tobago issues circulars and requires annual cybersecurity self-assessments; the Trinidad and Tobago Securities and Exchange Commission publishes administrative sanctions orders; the Telecommunications Authority publishes current market statistics and decisions; and the national cyber incident response team publishes incident statistics updated to 23 July 2026. None of those is a privacy regulator.

FLOORS. Anti-money-laundering: six years for all domestic and international transactions, customer due diligence identification data, account files and business correspondence, and the results of analysis of an account transaction. Securities: section 87(4) of the Securities Act, Chap. 83:02 requires any book, record or document kept under that Act to be kept for at least six years. Electronic money: clause 22 of the E-Money Issuer Order, 2020 requires record-keeping systems that retain customer and transaction files for a minimum of seven years. Gambling: seven years from completion of the transaction, on the licensed premises, once Part III is proclaimed. Passenger data: seven years under the Advance Passenger Information and Passenger Name Record Act, 2026, once proclaimed, with passenger name record data depersonalised after six months. CEILING. Principle (e) of section 6 of the Data Protection Act — in force — says personal information 'shall only be retained for as long as is necessary for the purpose collected'. There is no regulator, no penalty in force, and no published guidance, so the ceiling is unenforced. CONFLICT. Trinidad and Tobago's statutes do not contain an express conflict rule. In practice the specific statutory retention floors are enforceable and the general privacy ceiling is not, so the floor governs.

CLOCK 1 — Central Bank, 24 hours. The Cybersecurity Best Practices Guideline (September 2023), issued under section 10(b) of the Financial Institutions Act, 2008 and section 278(1) of the Insurance Act, 2018: 'As soon as possible but within 24 hours of becoming aware of a cyber-incident, the company shall alert the Central Bank, that a cyber-incident has occurred.' CLOCK 2 — Central Bank, 72 hours: the Cyber Incident Reporting Template must be submitted within 72 hours of the incident, followed by regular (for example daily) updates until resolution and a post-incident review. Failure to report may lead to enhanced supervisory reporting or compliance directions. A separate duty in the outsourcing guideline requires notifying the Central Bank of any unauthorised access or breach of confidentiality by a service provider or sub-contractor. CLOCK 3 — none for everyone else. The Data Protection Act contains no breach notification obligation at all, in force or otherwise. The Trinidad and Tobago Cyber Security Incident Response Team runs a reporting portal and publishes incident statistics, most recently updated 23 July 2026, but we found no statute making a report to it mandatory. FUTURE CLOCK: the Advance Passenger Information and Passenger Name Record Act, 2026 requires a high-risk personal data breach to be communicated to the individual and to a Data Protection Officer 'without undue delay' — that Act is not yet in force.

TRAP 1 — the law reads binding and is not. A plain text search of the Data Protection Act returns detailed duties on public bodies, private companies, directors and officers. Parts III, IV and V have never been proclaimed. A compliance programme built from the statute text alone will be built on sections that do not exist in operation. TRAP 2 — the Electronic Transactions Act, Chap. 22:05 is also only partly in force. Parts I to IV and Part VII commenced in January 2012. Part V (electronic authentication service providers), Part VI (liability of intermediaries and telecommunications service providers), Part VIII (consumer protection and unwanted commercial messages), Part IX (offences) and Part X have not commenced. There is therefore no in-force anti-spam rule and no in-force safe harbour for online intermediaries. TRAP 3 — compelled collection plus a gag. Under section 18 of the Interception of Communications Act, Chap. 15:08, an authorised officer holding a warrant may require a telecommunications provider not only to hand over communications data it holds but, 'if the provider is not already in possession of the data, to obtain the data and so disclose it', and the provider must not reveal the notice's existence to anyone other than its own staff and its lawyers. Section 13 makes failure to provide prompt interception assistance an offence carrying a fine of one million Trinidad and Tobago dollars, roughly one hundred and fifty thousand United States dollars. TRAP 4 — emergency powers. Emergency Powers Regulations made under section 7 of the Constitution and published on 3 March 2026 allow the Minister responsible for internal security to make Orders 'authorising the interrogation of computers and electronic devices seized'. Detention orders under those Regulations were still being gazetted through 2026. TRAP 5 — the sleeping penalty is unusually harsh. Section 95 of the Data Protection Act provides for imprisonment of up to five years on indictment, and section 96 allows a court to fine a corporation up to ten per cent of the annual turnover of the enterprise. Directors and officers who directed or assented to an offence commit the offence personally. None of Part V is in force, so this is a risk that could appear overnight rather than one that exists today.

COMING. The Advance Passenger Information and Passenger Name Record Act, 2026 (Act No. 7 of 2026) was assented to on 15 May 2026 and gazetted on 21 May 2026. Its section 2 says it comes into operation on a date fixed by the President by Proclamation. Parliament's own bill tracker records its status as 'Assent: Awaiting Proclamation'. It repeals and replaces the Immigration (Advance Passenger Information) Act and operationalises the CARICOM Advance Passenger Information System. NOT COMING, so far. We checked Parliament's bills index on 19 August 2026: no Data Protection (Amendment) Bill has been introduced. In January 2023 the responsible minister told the Senate that modernising amendments were being developed with international consultants and Inter-American Development Bank support; more than three years later no bill has been laid. DORMANT SWITCHES. First and largest: section 1(2) of the Data Protection Act lets the President by Proclamation bring any remaining section into force on any chosen day. That single act would switch on the public sector storage-and-access-only-in-Trinidad-and-Tobago rule in section 36, all private sector duties in Part IV, and the criminal and turnover-percentage penalties in Part V. Second: section 100 lets the Minister make Regulations under the Act. Third: section 71 lets the Information Commissioner, once appointed, order any industry to develop a mandatory code of conduct, and section 74 makes such a code binding. Fourth: Part III of the Gambling (Gaming and Betting) Control Act, 2021 can be proclaimed at any time, switching on the keep-records-on-the-premises licence condition. Fifth: Emergency Powers Regulations can be revived or amended under a state of public emergency. None of these requires consultation.