Law / Barbados

Data Protection Act, 2019

Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100

In force since 26 Mar 2021.

A comprehensive regime rule binding public and private bodies.

How the hook was established: express
What makes it apply: Operator establishment, Market targeting
Obligation class: Consent, Security, DPIA, Governance, Retention
Audit expectation: on_request
Who audits it: Regulator

What it requires

Before processing personal data, establish a lawful basis and confine processing to the stated purpose.NIST Privacy FrameworkCT.PO-P1
Register with the Data Protection Commissioner as a data controller or data processor before processing personal data.NIST Privacy FrameworkGV.PO-P5
Nominate a representative established in Barbados if you act as a data controller or data processor without being established there.NIST Privacy FrameworkGV.PO-P5
Implement technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption of personal data, the ability to restore availability and access in a timely manner after a physical or technical incident, and a process for regularly testing their effectiveness.NIST Privacy FrameworkPR.DS-P1 NIST Privacy FrameworkPR.PO-P7
Build data protection into the design of your processing and make it the default, and keep records of your processing activities.NIST Privacy FrameworkGV.PO-P2 NIST Privacy FrameworkID.IM-P4
Carry out a data protection impact assessment before any type of processing, in particular using new technologies, that is likely to result in a high risk to the rights and freedoms of an individual, taking the advice of the data privacy officer where one is designated, and consult the Commissioner beforehand where the assessment shows a high risk.NIST Privacy FrameworkID.RA-P4
Designate a data privacy officer where the Act requires one, give them the position and independence it prescribes, and let them carry out the duties it lists.NIST Privacy FrameworkGV.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

ID.IM-P4Data actions of the systems/products/services are inventoried.
ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.

2 more

PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
PR.DS-P1Data-at-rest are protected.

NIST CSF 2.0

PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

Section 60 requires a data controller, and a data processor for its processing on a controller's behalf, to maintain a record of processing activities listing contacts, purposes, categories of data subjects, data and recipients, transfers and security measures. Those contents are not values of the log-contents list. Section 60 states no counterpart of the GDPR Article 30(4) duty to produce the record, and the route to the Commissioner within this row is section 61, a duty to cooperate on request. Section 7(1) separately requires a controller to demonstrate that a data subject consented, without naming a record, and section 58(5)(h) has a processor make available the information needed to show compliance and allow audits by the controller.

Kind: Explicit
As of: 28 October 2026
Provision: Section 60 (records of processing activities)
Trigger: personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 3 applies the Act to processing personal data in the context of the activities of a data controller or data processor established in Barbados, and to processing the personal data of data subjects in Barbados by a controller or processor not established there where the activities relate to offering goods or services to them.

Section 4 sets the processing principles, requiring personal data to be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, adequate, relevant and limited to what those purposes need, accurate and kept up to date, kept in identifiable form no longer than the purpose requires, and processed with appropriate security using technical or organisational measures. Sections 5 to 7 govern fairness, lawfulness and the conditions for valid consent.

Sections 29 to 49 carry the exemptions, from national security and crime through journalism, research, legal privilege and examinations. Section 50 bars operating as a data controller without registration in the Register of Data Controllers and requires a controller not established in Barbados to nominate a representative there; section 55 imposes the same on a data processor.

Section 54 requires data protection by design and by default, section 60 requires records of processing activities, section 62 requires technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption, the ability to restore availability and access after a physical or technical incident, and a process for regularly testing their effectiveness.

Section 65 requires a data protection impact assessment before processing likely to result in a high risk, section 66 requires prior consultation with the Commissioner, and sections 67 to 69 govern the designation, position and duties of the data privacy officer. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.