Data controllers are responsible for compliance with certain privacy and data protection principles applicable to the personal data it processes. Data controllers are also responsible for ensuring that the principles are complied with, where personal data is processed on the data controller’s behalf (e.g., by its vendors).

Under these principles:

• a data controller shall not process personal data (other than sensitive personal data) without the express consent of the data subject, or transfer personal data outside of the British Virgin Islands without proof of adequate data protection safeguards or consent from the data subject, unless either of the Exceptions defined under the heading “Transfer” exists (the General Principle)
• a data controller must inform a data subject of: (a) the purposes for processing; (b) information as to the source of the personal data; (c) the rights to request access to and correction of the personal data; (d) how to contact the data controller; (e) the class of third parties to whom the personal data will be disclosed; and (f) whether the data is obligated to supply the personal data, and if so, the consequences of not supplying same (the Notice and Choice Principle)
• no personal data shall be disclosed without the consent of the data subject for any purposes other than the purpose for which the personal data was to be disclosed at the time of collection or to any party other than a third party of the class of third parties noted above (the Disclosure Principle)
• a data controller must take practical steps to protect personal data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration, or destruction by having regard to (a) the nature of the personal data and the harm that would result from any loss, misuse, etc.; (b) the place or location where the personal data is stored; (c) any security measures incorporated into any storage equipment; (d) the measures taken for ensuring the reliability, integrity, and competence of personnel having access to the personal data; and (e) the measures taken for ensuring the secure transfer of the personal data (the Security Principle)
• personal data shall not be kept longer than is necessary for the fulfillment of the purpose of processing, and data controllers must take all reasonable steps to ensure that personal data is destroyed or permanently deleted if no longer required for the purpose for which it was to be processed (the Retention Principle)
• a data controller shall take reasonable steps to ensure that personal data is accurate, complete, not misleading, and kept current (the Data Integrity Principle), and
• data subjects shall be given access to their personal data and be able to request corrections where the personal data is inaccurate, incomplete, misleading, or not current (the “Access Principle”)