Guyana’s Data Protection Act 2023 establishes a legal framework for personal-data processing, but the Act says it comes into operation on a date appointed by ministerial order. In December 2025, the Government said the legislation was not yet in force. A final check on 26 September 2026 did not locate a later Data Protection commencement order in the Official Gazette. Businesses should therefore verify the current legal status, regulations and official guidance before treating a particular statutory duty, deadline or procedure as operative.
1. Create a data inventory. List the customer, employee, applicant, supplier and website information held by the business.
2. Record the purpose. For every category, state why it is collected and how it is used. Remove fields collected without a clear need.
3. Map storage and access. Include computers, phones, cloud platforms, paper files, email accounts, backups and external processors.
4. Limit access. Give staff only the information required for their roles and review access when responsibilities change or employment ends.
5. Review notices and forms. Explain collection and use in plain language. Make sure the notice matches actual practice.
6. Check vendors. Contracts with payroll, marketing, storage and technology providers should address authorised use, confidentiality, security, incidents and deletion or return.
7. Set retention rules. Keep records for justified business or legal periods, then securely delete or destroy them.
8. Prepare for requests. Assign responsibility for locating relevant records and verifying the person making a request.
9. Prepare an incident plan. Define how staff report lost devices, misdirected email, unauthorised access or other exposure and who assesses the response.
10. Train and test. Short, role-specific training and occasional checks are more useful than an unread policy.
This checklist is a governance starting point, not a legal opinion. Sensitive information, surveillance, profiling, biometrics, international transfers or large-scale processing may require specialised advice.
