Processes personal data, in the Bahamas

Data Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, s. 17 (prohibition on transfer of personal data outside The Bahamas) · Read the law's page

• Before transferring personal data collected in The Bahamas to another country, be prepared to show the recipient provides protection equivalent to this Act if the Data Protection Commissioner questions the transfer.

Data Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 1-13 (application and data protection principles) · Read the law's page

• Collect personal data only by means that are lawful and fair, keep it accurate and up to date, and hold it only for the specified purposes it was collected for.
• Give an individual access to personal data held about them within forty days of a written request, and rectify or erase it on request where it breaches the collection principles.
• Stop using an individual's personal data for direct marketing within forty days of their written request.

Data Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences) · Read the law's page

• Do not disclose personal data processed on behalf of a data controller without that controller's prior authority.
• Do not obtain access to, or disclose, personal data without the authority of the data controller or data processor who holds it.
• Comply with an enforcement notice the Data Protection Commissioner serves requiring rectification, erasure or another specified step.

Data Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 8-11 (access, rectification or erasure and direct marketing objection) · Read the law's page

• Tell an individual who makes a written request whether the data you keep include personal data relating to them, supply a copy of the information constituting that data, and explain any terms an average person could not understand without explanation, within the period section 8(1) allows.
• Do not disclose personal data relating to another individual in answering an access request unless that individual has consented, but disclose the data with the identifying particulars omitted where that lets it be disclosed without identifying the other individual.
• If you refuse an access request, notify the individual in writing, give the reasons for the refusal and say that the individual may complain to the Data Protection Commissioner.
• Rectify or, where appropriate, erase personal data within forty days of an individual's written request where you have contravened section 6(1) in keeping it, and notify the individual within the same forty days that you have complied.
• Within forty days of a data subject's written request to stop using data kept for direct marketing, erase the data kept for that purpose or, if it is kept for other purposes too, cease using it for direct marketing, and notify the data subject in writing.

Data Protection Act, 2025 (No. 74 of 2025), Laws of The Bahamas, assented 9 December 2025, repealing the Data Protection (Privacy of Personal Information) Act, Ch. 324A · Read the law's page

• The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
• Do not subject a data subject to a decision based solely on automated data processing or profiling that produces legal effects concerning, or similarly affects, the data subject, unless the decision is necessary for a contract between you and the data subject, authorized by a written law that specifies suitable safeguards, or based on the data subject's consent; where you rely on the contract or consent exception, implement suitable measures to safeguard the data subject's fundamental rights and freedoms.
• Do not transfer personal data to a country, territory or international organization that does not ensure an adequate level of protection for the fundamental rights and freedoms of data subjects.
• Keep a written or electronic record of the data processing activities under your responsibility and make it available to the Commissioner on request.
• Notify the Commissioner within seventy-two hours of becoming aware of a personal data breach likely to result in a risk to an identifiable natural person or involving the unauthorized disclosure of sensitive personal data.

Data Protection Act, 2025 (No. 74 of 2025), ss. 12, 74-77, 80, 88, 90, 94-96 (enforcement, offences and penalty notices) · Read the law's page

• The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
• Comply with an enforcement notice the Data Protection Commissioner serves, by taking or refraining from the steps it specifies, or refraining from processing the personal data it describes or processing it for the purpose or in the manner it specifies, within the time it specifies, noting that the notice may not require compliance before the appeal period ends unless it states a case of urgency.
• Provide the information an information notice requires, in the form and within the period it specifies, except information that would expose you to proceedings for an offence other than one under the Act or for perjury, and communications with counsel and attorney that section 77(6) protects.
• Do not make a statement you know to be false in a material respect, or recklessly make a statement that is false in a material respect, in purported compliance with an information notice or a request for assessment.
• Do not, knowingly or recklessly and without the data controller's consent, obtain or disclose personal data or the information it contains, or procure its disclosure to another person, unless an exception in section 96(2) applies.
• Do not sell, rent or offer to sell personal data obtained in contravention of section 96(1); an advertisement indicating that personal data is or may be for sale is an offer to sell it.

Data Protection Act, 2025 (No. 74 of 2025), ss. 2(1), 35-36 (sensitive personal data) · Read the law's page

• The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
• Do not process sensitive personal data (racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, genetic data, biometric data used to identify a person uniquely, sex life or sexual orientation, medical data, health records, financial records or financial position, a criminal record or offence proceedings) without the data subject's consent in writing, unless an exception in section 35(2), (4), (5) or (6), or an order under section 35(7), applies.
• Process sensitive personal data relating to health only with the data subject's consent and by or under the responsibility of a health care professional or by a person bound by professional secrecy under a written law, unless section 36(2) applies.

Data Protection Act, 2025 (No. 74 of 2025), ss. 24-32 (data subject rights) · Read the law's page

• The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
• Tell a data subject whether you are processing their personal data and, on a written request with the prescribed fee, give them the information section 24(1) lists, communicating in a clear, intelligent and unambiguous manner, within thirty days of the request and the fee or any other period regulations prescribe.
• Do not supply an access request in a way that discloses personal data relating to another data subject unless that data subject has consented or it is reasonable in all the circumstances to comply without the consent, and supply the part that can be supplied without identifying the other data subject.
• If you are a data processor and receive an access request for personal data you process for a data controller, inform the data subject of the right to make the request to the data controller.
• Rectify inaccurate personal data without undue delay, complete incomplete personal data through a supplementary statement, and communicate the rectification to each recipient unless that proves impossible or involves disproportionate effort.
• Within twenty-one days of a data subject's written notice objecting under section 27(1), stop the processing unless you demonstrate compelling legitimate grounds that override the data subject's fundamental rights and freedoms, or the processing is for the purpose of legal proceedings, and give the data subject your reasons if you refuse.
• Erase personal data without undue delay on a ground in section 28(2) (no longer necessary, consent withdrawn, objection, unlawful processing or a legal obligation), subject to the overrides in section 28(4), and communicate the erasure to each recipient unless that proves impossible or involves disproportionate effort.
• Restrict the processing of personal data when the data subject requires it on a ground in section 29(1), and process restricted personal data, apart from storage, only on a basis section 29(2) allows.
• Cease, or do not begin, processing personal data on a data subject's written notice where the processing is causing or is likely to cause substantial damage or distress that is unwarranted, except where section 30(2) disapplies the right.
• On request, give a data subject the personal data they provided to you in a structured, commonly used and machine-readable format and transmit it directly to another data controller where technically feasible, where the processing is based on consent or a contract and carried out by automated means.

Data Protection Act, 2025 (No. 74 of 2025), ss. 48-49 (personal data breach notification) · Read the law's page

• The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
• Notify the Data Protection Commissioner within seventy-two hours of becoming aware of a personal data breach that is likely to result in a risk to the fundamental rights and freedoms, reputation, or other legitimate interests of an identifiable natural person, or that involves the unauthorized disclosure of sensitive personal data, and treat a breach as likely to result in a risk where it involves sensitive categories of personal data, could cause humiliation, harm, distress, reputational damage or economic loss to a data subject, or exposes personal data to unauthorized access, use or disclosure.
• If the notification is not made to the Commissioner within seventy-two hours, give the Commissioner the reasons for the delay.
• If you are a data processor, notify the data controller within seventy-two hours after having become aware of a breach of personal data.
• In the notification, describe the nature of the breach, specify its categories, the number of data subjects affected and the categories and number of personal data records affected, give the name and contact details of the data protection officer or other contact point, and describe the consequences of the breach, the measures taken or proposed to address it and the measures to mitigate its adverse effects; if all of this cannot be provided at once, provide it in phases within seven working days or an extended time as prescribed.
• Record every breach of personal data, describing the facts relating to the breach, its effects and the remedial action taken.
• Communicate a breach to the affected data subject within seventy-two hours after having become aware of it, in clear and plain language, where it is likely to result in the violation of the data subject's fundamental rights and freedoms or the unauthorized disclosure of the data subject's sensitive personal data, unless a condition in section 49(3) is satisfied.

Data Protection Act, 2025 (No. 74 of 2025), ss. 54-56 (transfer of personal data outside The Bahamas) · Read the law's page

• The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
• Do not transfer personal data to a country, territory or international organization unless it ensures an adequate level of protection for the fundamental rights and freedoms of data subjects in relation to the processing of personal data, judged in all the circumstances of the case, having regard to the nature of the data, its origin and final destination, the purposes and period of processing, the applicable laws and international obligations of the recipient, any enforceable codes of conduct and the security measures taken there.
• If you rely on section 55 for a transfer of personal data outside The Bahamas, make sure one of its conditions is met: the data subject consents; the transfer is necessary for a contract with the data subject, for a contract concluded in the data subject's interest, for a matter of public interest the Minister specifies by order, for a legal claim, to protect the data subject or others where the data subject cannot consent, or for your compelling legitimate interests not overridden by the data subject's rights; or the data is part of the personal data on the public register and the register's conditions of inspection are complied with.
• Within one year after the Act commences, review your arrangements for the storage or processing of personal data by third parties, inside or outside The Bahamas, and the contracts or other mechanisms governing the cross-border transfer or storage of personal data, in a manner proportionate to the nature, scope and volume of the personal data and the risks to data subjects.