Duty LXD-3373
Makes education decisions, in the Bahamas
Each law's tag says when it binds: proposed proposed from a date not yet set not yet in force
Artificial Intelligence Governance Act (announced) — National AI Committee / AI Authorityproposed0 lines
Announced in the Speech from the Throne, House of Assembly, Parliament of The Bahamas, (Governor General Dame Cynthia Pratt); reaffirmed by Hon. Sebastian Bastian, Minister of Innovation and National Development, 2026/2027 Budget Debate contribution, House of Assembly, ; no bill text published as of this review
Data Protection Act, 2025 (formerly Data Protection Bill 2025)from a date not yet set2 lines
Data Protection Act, 2025 (Act No. 74 of 2025), Laws of The Bahamas; assented ; Official Gazette Supplement Part I published
- This law is recorded as enacted, but the record carries no commencement date, so whether it is yet in force has to be established before relying on what follows.
- Inform the data subject of the reasons for a decision, when automated processing is the sole basis for a decision that significantly affects them, such as their performance at work, creditworthiness, reliability, or conduct.
Data Protection Act, 2025, comprehensive regime as enactedfrom a date not yet set5 lines
Data Protection Act, 2025 (No. 74 of 2025), Laws of The Bahamas, assented , repealing the Data Protection (Privacy of Personal Information) Act, Ch. 324A · Read the law's page
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Do not subject a data subject to a decision based solely on automated data processing or profiling that produces legal effects concerning, or similarly affects, the data subject, unless the decision is necessary for a contract between you and the data subject, authorized by a written law that specifies suitable safeguards, or based on the data subject's consent; where you rely on the contract or consent exception, implement suitable measures to safeguard the data subject's fundamental rights and freedoms.
- Do not transfer personal data to a country, territory or international organization that does not ensure an adequate level of protection for the fundamental rights and freedoms of data subjects.
- Keep a written or electronic record of the data processing activities under your responsibility and make it available to the Commissioner on request.
- Notify the Commissioner within seventy-two hours of becoming aware of a personal data breach likely to result in a risk to an identifiable natural person or involving the unauthorized disclosure of sensitive personal data.
Data Protection Act, 2025, data subject rightsfrom a date not yet set10 lines
Data Protection Act, 2025 (No. 74 of 2025), ss. 24-32 (data subject rights) · Read the law's page
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Tell a data subject whether you are processing their personal data and, on a written request with the prescribed fee, give them the information section 24(1) lists, communicating in a clear, intelligent and unambiguous manner, within thirty days of the request and the fee or any other period regulations prescribe.
- Do not supply an access request in a way that discloses personal data relating to another data subject unless that data subject has consented or it is reasonable in all the circumstances to comply without the consent, and supply the part that can be supplied without identifying the other data subject.
- If you are a data processor and receive an access request for personal data you process for a data controller, inform the data subject of the right to make the request to the data controller.
- Rectify inaccurate personal data without undue delay, complete incomplete personal data through a supplementary statement, and communicate the rectification to each recipient unless that proves impossible or involves disproportionate effort.
- Within twenty-one days of a data subject's written notice objecting under section 27(1), stop the processing unless you demonstrate compelling legitimate grounds that override the data subject's fundamental rights and freedoms, or the processing is for the purpose of legal proceedings, and give the data subject your reasons if you refuse.
- Erase personal data without undue delay on a ground in section 28(2) (no longer necessary, consent withdrawn, objection, unlawful processing or a legal obligation), subject to the overrides in section 28(4), and communicate the erasure to each recipient unless that proves impossible or involves disproportionate effort.
- Restrict the processing of personal data when the data subject requires it on a ground in section 29(1), and process restricted personal data, apart from storage, only on a basis section 29(2) allows.
- Cease, or do not begin, processing personal data on a data subject's written notice where the processing is causing or is likely to cause substantial damage or distress that is unwarranted, except where section 30(2) disapplies the right.
- On request, give a data subject the personal data they provided to you in a structured, commonly used and machine-readable format and transmit it directly to another data controller where technically feasible, where the processing is based on consent or a contract and carried out by automated means.