AI governance in Trinidad and Tobago: the law today and where policy is heading

Organisations in Trinidad and Tobago are adopting AI faster than the law around it is being completed. There is no AI-specific statute, the main data protection law is only partly in operation, and national AI policy is still being shaped. That leaves organisations to set their own guardrails, with a clear sense of where the law is likely to go.

What the law says today

The Data Protection Act, Chap. 22:04 was passed in 2011 and designed in layers. Two proclamations have brought parts of it into operation. Since 6 January 2012, Part I and the provisions establishing the Office of the Information Commissioner have applied. Since 23 August 2021, section 42(a) and (b), on when public bodies may disclose personal information, have applied too.

Part III, with detailed duties for public bodies, Part IV, which applies the principles to the private sector, and Part V, with the offences and penalties, have not been proclaimed. In practice that means there is no complaints route under the Act and no penalty for breaching the principles.

The principles themselves are in operation, though. Section 6 sets out twelve General Privacy Principles and says they apply to all persons who handle, store or process personal information belonging to another person. For AI, four of them do most of the work.

• Purpose. The purpose of collecting personal information is identified before or at collection. Using customer or staff data to train or run an AI system for a different purpose cuts across this.
• Consent. The individual’s knowledge and consent are needed for collection, use or disclosure.
• Accuracy. Information is kept accurate, complete and up to date for its purpose, which matters when a model makes inferences about people.
• Openness and challenge. Organisations make their policies and practices available, and people can challenge compliance and get a timely response.

The principles also say information sent outside Trinidad and Tobago should be regulated, with comparable safeguards in the receiving jurisdiction, which is relevant to every AI service hosted abroad.

Where AI policy is heading

On 23 May 2025 the government merged the Ministry of Public Administration and the Ministry of Digital Transformation into the Ministry of Public Administration and Artificial Intelligence. It leads the government’s AI work.

On 26 November 2025 the ministry launched a National AI Assessment with UNDP and UNESCO, combining UNDP’s AI Landscape Assessment with UNESCO’s Readiness Assessment Methodology, which is built on the UNESCO Recommendation on the Ethics of AI. Consultations in January 2026 covered the legal and regulatory, technological, scientific and educational, societal and cultural, and economic dimensions, and a national validation workshop was held at The University of the West Indies, St. Augustine, on 27 February 2026. The validated findings are to inform a national AI roadmap. The ministry has also launched an AI Academy and called for a united Caribbean approach to AI.

For organisations, the direction is towards a national AI policy, but its content and timing are not yet known.

A practical baseline

Without binding rules, the most durable approach is to build governance that would satisfy the principles already in operation and the international frameworks the national roadmap is likely to draw on.

1. Know what AI you run. List every AI system and agent, including AI features inside software already in use and tools staff have adopted themselves, with the personal information each uses. Our guide to building an AI system register covers the fields.
2. Set the rules for staff. An AI acceptable use policy that says which tools are approved and what data may go into them prevents most early problems, especially pasting personal information into public AI tools.
3. Assess the systems that matter. Run an AI impact assessment for systems that decide things about people, covering purpose, consent, accuracy and the safeguards in place.
4. Check where data goes. For each AI service hosted outside Trinidad and Tobago, find out where it processes data and what safeguards the contract provides.
5. Pick a backbone. ISO/IEC 42001 and the NIST AI RMF are the common choices. Either gives a structure that carries over when the rest of the Data Protection Act is proclaimed or replaced, and when the national roadmap arrives.

Banks, insurers and securities firms should also follow the governance and risk expectations of the Central Bank of Trinidad and Tobago and the Trinidad and Tobago Securities and Exchange Commission, which apply to AI as to any other technology they use.

Aicura’s register, discovery, policies, assessments and guardrails support this work. Aicura gives support and guidance for your own judgement and your advisers’, and it does not decide how the law applies to you.