Privacy Policy

Data We Collect

The DPMS processes the following categories of data:

• Staff accounts: Name, email address, role, and ministry affiliation
• Decision records: Decision titles, descriptions, supporting evidence, legal opinions, and correspondence
• Audit trail: System actions, timestamps, and user identifiers for accountability purposes
• Public portal: No personal data is collected from public visitors. Published decisions are redacted to remove sensitive personal information.

Legal Basis for Processing

Personal data is processed under the legal authority of the Government of the Virgin Islands for the administration of public functions, in accordance with:

• The Virgin Islands Constitution Order 2007
• The Public Service Management Act 2024
• Commission of Inquiry recommendations (2022)

Data Security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access is restricted by role-based permissions
• An immutable, cryptographically chained audit trail records all system actions
• Passwords are hashed using bcrypt with a cost factor of 12
• Multi-factor authentication is available for elevated roles

Data Retention

Decision records and audit trails are retained for a minimum of 7 years in accordance with government records management policy. Personal account data is retained for the duration of employment and archived thereafter.

Your Rights

You have the right to:

• Request access to your personal data held in the system
• Request correction of inaccurate personal data
• Request information about how your data is used

To exercise these rights, contact the Data Protection Officer at privacy@gov.vg.

Contact

• Data Protection Officer: privacy@gov.vg
• Government Information Office: Central Administration Complex, Road Town, Tortola, BVI