The Data Protection Act, 2021 was enacted, on 13 April 2021, in the Official Gazette. In particular, the Act applies to a person who processes or who has control over, or authorises, the processing of any personal data in respect of commercial transactions, and also applies to a person in respect of personal data if:

• the person is established in the Virgin Islands and processes personal data, or employs or engages any other person to process personal data on their behalf, whether or not in the context of that establishment; or 
• the person is not established in the Virgin Islands, but uses equipment in the Virgin Islands for processing personal data otherwise than for the purposes of transit through Virgin Islands.

Additionally, the Act also provides for various principles such as notice and choice, disclosure, security, and retention, among others, and establishes data subject rights such as the right of access, rectification, prevention of processing for direct marketing purposes, as well as rights with respect to the processing of sensitive personal data. Furthermore, the Act provides for the establishment of the Office of the Information Commissioner with powers to monitor, investigate, and enforce compliance with the Act, among other powers.

Lastly, the Act will enter into force on a date appointed by the Minister, by notice published in the Gazette, and different dates may be appointed for different provisions of the Act.

You can read the Act here.