Gibraltar Data Protection Act 2004

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	GI DPA 2004
Region	Europe
Country or scope	Gibraltar
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers GI DPA 2004

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`GI-GDPR-32` Security of Processing	Controllers and processors must implement technical and organisational measures ensuring integrity and confidentiality of processing systems, including the ability to verify software integrity (Gibraltar GDPR Art. 32)	Scan
`GI-GDPR-5F` Integrity and Confidentiality Principle	Personal data must be processed in a manner ensuring appropriate security, which requires knowing the exact version of every processing component so security state can be assessed (Gibraltar GDPR Art. 5(1)(f))	Scan
`GI-GDPR-30` Records of Processing Activities	Controllers and processors must maintain records of processing activities, including a named, populated inventory of the software systems involved (Gibraltar GDPR Art. 30)	Scan
`GI-GDPR-28` Processor Guarantees	Controllers may only engage processors providing sufficient guarantees, requiring visibility into the suppliers of third-party components handling personal data (Gibraltar GDPR Art. 28)	Scan
`GI-GDPR-33` Breach Notification Readiness	Breach notification within 72 hours requires the ability to identify precisely which components were affected by an incident (Gibraltar GDPR Arts. 33-34)	Scan
`GI-DPA-DOC` Documented Accountability	The national act supplementing the Gibraltar GDPR expects controllers to be able to demonstrate compliance through identifiable, timestamped system documentation (Data Protection Act 2004, national accountability provisions)	Scan

All 22 from the standard set, adapted to GI DPA 2004.