Executive summary
Create a National Digital Trust Layer.
Saint Lucia is preparing digital systems across land, transport, health, education, social protection, payments and identity. The same systems join sensitive records and decisions across agencies, which increases both their public value and the cost of weak controls.
The official revised Data Protection Act records partial commencement. World Bank reporting through February 2026 did not count a Saint Lucia CIRT as operational under the project indicator, and the national CERT procurement was recorded as cancelled in a February procurement plan. Those dated records do not establish the position today; government should publish the current operating baseline.
SLPA proposes five gates for every critical digital service: lawful processing, independent redress, incident command, procurement control and AI accountability. Legal authority and citizen redress remain national; continuous monitoring and specialist forensics can be pooled regionally under measurable service levels.
Developed from a July 2026 SLPA editorial research package using official law, government procurement records, World Bank programme reporting and Caribbean AI governance work.
Key findings
Rights need an operating route.
Commencing legal duties without a funded Commissioner, complaints channel and enforcement process can create rights that citizens cannot use. The commencement schedule, budget, appointments and service standards should be published together.
Evidence-led findingOne incident commander is essential.
A breach can cross ministries, vendors and critical services. Saint Lucia needs a domestic command team with authority, reporting rules and recovery exercises even if 24/7 monitoring and specialist forensics are procured regionally.
Evidence-led findingProcurement controls risk before launch.
Every critical system should pass a data map, privacy assessment, threat model, recovery test, accessibility review, audit-rights test and vendor-exit plan before approval.
Evidence-led findingAI use should be visible and appealable.
A public register should identify purpose, owner, data, vendor and impact level. Consequential uses require performance testing, logs and meaningful human appeal; citizen data should not be reused for vendor training without a lawful basis.
Evidence-led findingDigital delivery signal
Reported programme outputs exceeded their end targets.
people or firmsAdministrative CARDTP counts for Saint Lucia through 20 February 2026. These are programme outputs, not national digital-literacy, employment or productivity rates.
SLPA policy proposal
National Digital Trust Layer
Scale digital public services through enforceable common rules, clear redress and tested recovery—not disconnected project safeguards.
Complete privacy enforcement
Commence the provisions needed for an independent Commissioner, citizen rights, investigations, appeals and penalties, with budget and service channels.
Domestic incident command
Establish a national CIRT command function and competitively procure continuous regional monitoring, threat intelligence and forensics.
One procurement gate
Require privacy, security, accessibility, recovery, audit, portability and exit evidence before any critical system launches.
Public AI controls
Register government AI uses and require impact tests, logs and human appeal for high-risk decisions.
Assisted access remains
Keep usable non-digital and assisted routes until evidence shows that removing them will not exclude residents.
Delivery sequence
Name owners and expose the baseline
- Inventory critical systems, data, vendors and AI uses.
- Publish the privacy-law commencement plan and issue interim procurement gates.
- Run one cross-government recovery exercise.
Open redress and response
- Establish the Commissioner’s budget and appointment process.
- Restart or replace the cancelled national CIRT procurement.
- Contract interim monitoring and publish the first scorecard.
Test the trust layer
- Independently review identity, payments, land, health and social-protection systems.
- Complete recovery exercises for the government data centre and two essential services.
- Publish Commissioner and CIRT reports with remediation status.
Public accountability
Measures for public accountability
Recommended publication: quarterly operating signals and one independently reviewed annual outcome report.Shows whether rights and enforcement have legal effect.
Tests whether redress works in practice.
Measures incident command and response.
Controls risk before public dependence grows.
Makes consequential automation inspectable.
Limits, uncertainty & sources
Limits of this analysis
- World Bank project status and procurement records are dated snapshots; current operating status requires confirmation.
- Undisbursed project funds may already be committed and are not automatically available for reallocation.
- A rise in reported incidents can reflect better detection and disclosure rather than worsening security.
- Programme participation counts do not establish national skills, employment or productivity outcomes.
Primary and institutional sources
01