LexLint

Know the law your code answers to.

Law / Barbados

Data Protection Act, 2019

Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 26 March 2021.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Before processing personal data, establish a lawful basis and confine processing to the stated purpose.
  • Register with the Data Protection Commissioner as a data controller or data processor before processing personal data.
  • Nominate a representative established in Barbados if you act as a data controller or data processor without being established there.
  • Implement technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption of personal data, the ability to restore availability and access in a timely manner after a physical or technical incident, and a process for regularly testing their effectiveness.
  • Build data protection into the design of your processing and make it the default, and keep records of your processing activities.
  • Carry out a data protection impact assessment before any type of processing, in particular using new technologies, that is likely to result in a high risk to the rights and freedoms of an individual, taking the advice of the data privacy officer where one is designated, and consult the Commissioner beforehand where the assessment shows a high risk.
  • Designate a data privacy officer where the Act requires one, give them the position and independence it prescribes, and let them carry out the duties it lists.

What it reaches

Obligation class

Consent, Security, DPIA, Governance, Retention

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 3 applies the Act to processing personal data in the context of the activities of a data controller or data processor established in Barbados, and to processing the personal data of data subjects in Barbados by a controller or processor not established there where the activities relate to offering goods or services to them.

Section 4 sets the processing principles, requiring personal data to be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, adequate, relevant and limited to what those purposes need, accurate and kept up to date, kept in identifiable form no longer than the purpose requires, and processed with appropriate security using technical or organisational measures. Sections 5 to 7 govern fairness, lawfulness and the conditions for valid consent.

Sections 29 to 49 carry the exemptions, from national security and crime through journalism, research, legal privilege and examinations. Section 50 bars operating as a data controller without registration in the Register of Data Controllers and requires a controller not established in Barbados to nominate a representative there; section 55 imposes the same on a data processor.

Section 54 requires data protection by design and by default, section 60 requires records of processing activities, section 62 requires technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption, the ability to restore availability and access after a physical or technical incident, and a process for regularly testing their effectiveness.

Section 65 requires a data protection impact assessment before processing likely to result in a high risk, section 66 requires prior consultation with the Commissioner, and sections 67 to 69 govern the designation, position and duties of the data privacy officer. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

Official text of the Data Protection Act, 2019 (Act 2019-29), Office of the Attorney General of Barbados

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app