Trinidad and Tobago Data Protection Act, Chap. 22:04

What it is

The Data Protection Act, Act 13 of 2011, now Chapter 22:04 of the Laws of Trinidad and Tobago, is the country’s data protection law. It was designed in three layers. Part I sets out General Privacy Principles. Part II creates the Office of the Information Commissioner. Part III sets detailed rules for public bodies and Part IV applies the principles to the private sector, each with complaints, enquiries and enforcement.

Only the first layer and part of the second are in operation. Section 1(2) leaves commencement to presidential proclamation, and two proclamations have been made. The official text published on laws.gov.tt carries the note that the Act has only been partially proclaimed.

Which parts are in force

• Legal Notice No. 2 of 2012. From 6 January 2012, Part I and sections 7 to 18, 22, 23, 25(1), 26 and 28 of Part II. That covers the definitions, the General Privacy Principles in section 6, and the provisions establishing the Office of the Information Commissioner, its powers and functions, staff and accounts.
• Legal Notice No. 220 of 2021. From 23 August 2021, section 42(a) and (b), which deal with when a public body may disclose personal information.

Part III on public bodies (apart from section 42(a) and (b)), Part IV on the private sector and Part V on contravention and enforcement remain unproclaimed. Those are the Parts with the complaints, enquiries, offences and penalties that would give the Act teeth.

What the General Privacy Principles say

Section 6 lists twelve principles that apply to all persons who handle, store or process personal information belonging to another person. In summary, they say the following.

• an organisation is responsible for the personal information under its control
• the purpose of collection is identified before or at the time of collection
• the individual’s knowledge and consent are required for collection, use or disclosure
• collection is lawful and limited to what the purpose needs
• information is kept only as long as necessary and not disclosed for other purposes without prior consent
• information is accurate, complete and up to date for its purpose
• information is protected by safeguards suited to its sensitivity
• sensitive personal information is protected from processing except where written law provides otherwise
• organisations make their personal information policies and practices available
• on request, organisations disclose documents about the existence, use and disclosure of a person’s information so they can challenge its accuracy
• individuals can challenge an organisation’s compliance with the principles and get a timely response
• information disclosed outside Trinidad and Tobago is regulated, with comparable safeguards in the receiving jurisdiction

For AI, the principles that matter most are purpose, consent, accuracy and openness. An AI system that reuses customer or employee data for a new purpose, such as training or scoring, sits uneasily with the purpose and consent principles. A system that makes inferences about people raises the accuracy and challenge principles. And a policy that does not say AI is used is hard to square with the openness principle.

What the unproclaimed Parts would add

Part III would give public bodies detailed duties, several of them directly relevant to AI. Section 47 would require a privacy impact assessment, in the Commissioner’s prescribed form, for any proposed system, project, programme or activity that would substantially or materially affect personal information, submitted to the Commissioner for approval. Section 50 would require the Commissioner’s approval for data matching. Part IV would apply the General Privacy Principles to private sector organisations through codes of practice and the Commissioner’s audit and enquiry powers.

Key dates

• 2011. The Data Protection Act passed as Act 13 of 2011.
• 6 January 2012. Part I and parts of Part II come into operation under Legal Notice No. 2 of 2012.
• 23 August 2021. Section 42(a) and (b) come into operation under Legal Notice No. 220 of 2021.
• 23 May 2025. The Ministry of Public Administration and the Ministry of Digital Transformation are merged into the Ministry of Public Administration and Artificial Intelligence.
• 26 November 2025. The ministry launches the National AI Assessment with UNDP and UNESCO.
• 27 February 2026. National validation workshop on the UNESCO readiness findings, which are to inform a national AI roadmap.

How it relates to other frameworks

The General Privacy Principles closely follow the fair information principles in Schedule 1 of Canada’s PIPEDA, from accountability and identified purposes to openness, access and challenging compliance, rather than the GDPR. Unlike Jamaica’s Data Protection Act, which has been in operation since December 2023 and has a specific rule on automated decisions, Trinidad and Tobago’s Act has neither working enforcement nor an automated decision rule.

With no AI-specific law and a national AI policy still being developed through the readiness assessment, organisations in Trinidad and Tobago that want a structure for AI governance usually adopt an international one. ISO/IEC 42001 and the NIST AI RMF are the common choices, with the UNESCO Recommendation on the Ethics of AI as the reference for the government’s own assessment.

A note on this page

This is Aicura’s reading of the Data Protection Act and its commencement. It is not legal advice and it is not the Act itself. Read the official text and legal notices on laws.gov.tt, and take advice on how the Act applies to your organisation.