Guyana’s Data Protection Act 2023: enactment and commencement

Enactment, and the position on commencement

The Data Protection Act 2023 (Act No. 18 of 2023) was passed by the National Assembly on 9 August 2023 and published in the Official Gazette on 16 August 2023. The Act provides that it comes into operation on a date appointed by the Minister by order. Passage and gazetting are not the same as commencement.

As at the sources checked for this note, including a search of the official e-gazette through mid-November 2026, no commencement order bringing the Data Protection Act into operation has been identified. On 3 December 2025 the Attorney General and Minister of Legal Affairs stated, in remarks reported by the Ministry of Legal Affairs and the Department of Public Information, that commencement orders for the Data Protection Act and for the Digital Identity Card Act had not then been activated. He described both statutes as complex, and said that the necessary administrative apparatus, centres, personnel and infrastructure had to be put in place before the laws would be brought into force.

The Digital Identity Card Act 2023 was later brought into operation on 31 March 2026 by the Digital Identity Card Act 2023 (Commencement) Order 2026 (Order No. 73 of 2026), published in the Official Gazette (Extraordinary) of 26 March 2026. That contrast is useful. It shows that a commencement order, published in the Gazette, is the instrument that matters, and that, unlike the digital-identity statute, no corresponding order for the Data Protection Act has been identified in this review. A newspaper letter, or a statement that organisations “should prepare”, is not a Gazette commencement order.

What that means in practice

Until a commencement order is made and the appointed date has arrived, the operative duties in the Data Protection Act should not be treated as being in force. This note therefore does not summarise those duties as if they already bind controllers or processors in Guyana. Once the Act is brought into operation, organisations that process personal data in, or in relation to, Guyana will need to read its requirements in full, including any regulations or guidance issued under it, and to consider how those requirements interact with existing confidentiality, employment, banking and public-sector rules.

Organisations that already apply international data-protection standards as a matter of contract or group policy may continue to do so. That is a matter of private obligation or good practice, not of the 2023 Act having commenced. Counsel should check the Official Gazette for any commencement order issued after the date of this note.