Compliance FrameworksAmericas
British Virgin Islands Data Protection Act 2021
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | VG DPA 2021 |
| Region | Americas |
| Country or scope | British Virgin Islands |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers VG DPA 2021
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
VG-DPA-SEC Security Measures | Data controllers must take practical steps to protect personal data from loss, misuse, modification or unauthorized access, including the ability to verify integrity of the processing software (Data Protection Act 2021, security principle) | Scan |
VG-DPA-PROC Processor Guarantees | Where a processor processes data on a controller's behalf, the controller must obtain sufficient guarantees that reasonable technical and organizational measures are in place, requiring supplier visibility for third-party components (Data Protection Act 2021, processor provisions) | Scan |
VG-DPA-INT Data Integrity | Personal data must be accurate, complete, not misleading and kept up to date, which requires knowing the exact version of every component that processes it (Data Protection Act 2021, data integrity principle) | Scan |
VG-DPA-PRIN Protection Principles Compliance | Processing must comply with the Act's data-protection principles, presupposing fully described processing components with both name and version (Data Protection Act 2021, data protection principles) | Scan |
VG-DPA-ACC Accountable Processing Inventory | Public and private bodies subject to the Act must be able to account for the systems and software through which they process personal data (Data Protection Act 2021, controller obligations) | Scan |
VG-DPA-TRA Transparent, Documented Processing | Notice and transparency duties toward data subjects presume identifiable, timestamped documentation of processing systems (Data Protection Act 2021, notice and choice principle) | Scan |
Policy templates
All 22 from the standard set, adapted to VG DPA 2021.