On August 16, 2023, the Data Protection Act No.18 of 2023 was published in the Official Gazette of Guyana and, on the same date, received Presidential assent. In particular, the Act among other things, regulates the collection, keeping, processing, use, and dissemination of personal data. 

Scope

The Act applies to the data controllers and processors established in Guyana and to controllers and processors not based in Guyana where:

• they use equipment in Guyana for processing otherwise than for the purpose of transit through Guyana;
• the processing activities are related to the offering of goods and services to data subjects in Guyana; or
• the monitoring of the behavior of data subjects as far as their behavior takes place in Guyana.

Notable provisions

The Act provides for key definitions, including 'data controller', 'consent', 'personal data', 'biometric data', 'child', 'sensitive personal data', etc. Importantly, the Act provides for controller and processor obligations and prohibits data controllers and processors from operating unless they have registered in the 'Register of Data Controllers'/'Register of Processors'. Further, the Act also provides for certain exemptions from its application, including among others, for the purposes of taxation and detection of crime. Moreover, the Act provides for the rights of data subjects including the right to access, portability, rectification, not to be subjected to decisions solely based on automated processing (including profiling), and the right to prevent processing likely to cause damage or distress.

Next steps 

The Act will come into effect on the day the Minister responsible for data protection may, by order, appoint, and different days may be appointed for different provisions of the Act. 

You can download the Act here and view its legislative history here.