← Global Privacy Laws Research Library
Act 2019-29
Barbados Data Protection Act, 2019-29
Prepared by Shubhank Suman · Last reviewed
Enacted text; commencement proclamation not included
- Legal character
- National statute
- Region
- Latin America
- Assent
- 12 August 2019
- Published
- 15 August 2019 (Gazette supplement)
What it covers
Processing principles and lawful bases, children and sensitive data, individual rights, international transfers, exemptions, controller/processor registration, accountability, security, breaches, impact assessments, privacy officers and enforcement.
Why it matters
Combines rights, profiling safeguards and operational accountability. The statute’s own scope and exemptions apply; resemblance to GDPR does not make GDPR universally applicable in Barbados.
Refer to it when
Research Barbados personal-data processing, automated profiling, portability, overseas transfers, registration, security incidents or privacy-officer duties.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
Profiling, significant automated decisions and high-risk processing assessments; not an AI Act.
Privacy
VERY HIGH
Rights, transfers and processing accountability.
Cybersecurity
HIGH
Security and separate Commissioner/data-subject breach procedures.
Applicability
Section 3 application tests and sections 29-49 exemptions must be read before relying on duties; controller and processor obligations are distinct.
Read first
Section 3 → 4-9 → 10-28 → applicable exemptions → 50-69 → 90-95 and 100.
Provisions / sections covered
Sections 3-9 - Scope and principles
Application, processing principles, lawful bases, consent and provisions addressing children and sensitive personal data.
Sections 10-21 - Rights and transparency
Access, rectification, erasure, restriction, portability, direct marketing and section 18 automated decisions/profiling with exceptions and safeguards.
Sections 22-28 - Overseas transfers
Adequacy, appropriate safeguards, binding corporate rules and specific derogations; not unrestricted export based on any consent.
Sections 50-64 - Accountability and breaches
Controller/processor registration, design/default, records and security. Section 63 requires Commissioner notice without undue delay and where feasible within 72 hours unless risk is unlikely. Section 64 separately addresses high-risk subject notice with its own 72-hour wording and exceptions.
Sections 65-69, 90-95 and 100 - Risk, redress and commencement
DPIAs, prior consultation, privacy officers, Tribunal/compensation/penalties and commencement by proclamation.
Subject-matter tags
- Consent
- Sensitive data
- Children's data
- Erasure and deletion
- Data portability
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Direct marketing
- Enforcement and penalties
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.