Processes personal data, in Barbados

Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100 · Read the law's page

• Before processing personal data, establish a lawful basis and confine processing to the stated purpose.
• Register with the Data Protection Commissioner as a data controller or data processor before processing personal data.
• Nominate a representative established in Barbados if you act as a data controller or data processor without being established there.
• Implement technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption of personal data, the ability to restore availability and access in a timely manner after a physical or technical incident, and a process for regularly testing their effectiveness.
• Build data protection into the design of your processing and make it the default, and keep records of your processing activities.
• Carry out a data protection impact assessment before any type of processing, in particular using new technologies, that is likely to result in a high risk to the rights and freedoms of an individual, taking the advice of the data privacy officer where one is designated, and consult the Commissioner beforehand where the assessment shows a high risk.
• Designate a data privacy officer where the Act requires one, give them the position and independence it prescribes, and let them carry out the duties it lists.

Data Protection Act, 2019, ss. 10-17, 19-21 (rights of a data subject) · Read the law's page

• When collecting personal data, or promptly after obtaining it from another source, give the data subject the required notice, including of any automated decision-making and meaningful information about its logic.
• Honour a data subject's rights to access, rectification, erasure, restriction, portability, and objection to direct marketing.
• Notify every recipient the personal data was disclosed to of a rectification, erasure or restriction of processing you carry out.
• Stop processing personal data for the purposes of direct marketing as soon as the data subject asks you to, with no ground for refusing.

Data Protection Act, 2019, ss. 22-28 (transfers of personal data outside of Barbados) · Read the law's page

• Before transferring personal data outside Barbados, confirm the destination provides an adequate level of protection or rely on an appropriate safeguard such as standard clauses or binding corporate rules.
• Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the countries of origin and final destination, the purposes and period of the intended processing, the law in force and international obligations there, any enforceable codes of conduct, and the security measures taken in that country or territory.
• Submit any binding corporate rules you rely on to the Commissioner for authorisation, and make them specify what section 25 requires, including the data subjects' rights and how to exercise them, the acceptance of liability, the complaint procedures and the compliance-verification mechanisms.
• Where you rely on a derogation in section 26 instead, make sure it is one the section lists, such as the data subject's consent, contractual necessity, substantial public interest, legal proceedings, vital interests, a public register, or terms approved or a transfer authorised by the Commissioner.

Data Protection Act, 2019, ss. 63-64 (personal data breach notification) · Read the law's page

• Notify a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and give reasons for the delay if you notify later.
• Communicate a personal data breach likely to result in a high risk to the rights and freedoms of individuals to the affected data subject, in clear and plain language, without undue delay and, where feasible, not later than 72 hours after becoming aware of it.
• As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.
• Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned, the contact point for more information, the likely consequences and the measures taken, supplying the information in phases without undue further delay where it cannot all be given at once.
• Document every personal data breach, its facts, its effects and the remedial action taken, so the Commissioner can assess compliance.

Data Protection Act, 2019, ss. 70-95 (Commissioner, enforcement, tribunal and penalties) · Read the law's page

• Comply with an enforcement notice the Commissioner serves within the time it specifies, including any requirement to stop processing personal data or a description of personal data, because failing to comply with a notice is itself an offence.
• Answer an information notice or a special information notice from the Commissioner, and do not obstruct the execution of a warrant issued under the Act.
• Expect an individual who suffers damage or distress from a contravention to be able to claim compensation from you, and expect to have to prove you took all the measures reasonably required to comply in order to defend the claim.
• Expect the Commissioner to be able to order an administrative penalty of up to $50,000 after a hearing for contravening the registration-change, records, cooperation, security, breach-notification, impact-assessment, prior-consultation or data-privacy-officer duties, on top of the Act's criminal fines.

Data Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data) · Read the law's page

• Do not process sensitive personal data, including biometric data, unless the data subject consents or a specific statutory ground applies.
• Process a child's personal data only where consent is given or authorised by the child's parent or guardian, a child being a person under the age of 18.
• Make reasonable efforts to verify that the consent to process a child's personal data was given or authorised by a parent or guardian, taking available technology into account.
• Where you rely on the not-for-profit or equality-monitoring grounds in section 9, carry the processing out with appropriate safeguards for the rights and freedoms of data subjects, and do not disclose the data to a third party without the data subject's consent.