BarbadosData Protection Act, 2019, transfers of personal data outside of Barbados
Data Protection Act, 2019, ss. 22-28 (transfers of personal data outside of Barbados)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Before transferring personal data outside Barbados, confirm the destination provides an adequate level of protection or rely on an appropriate safeguard such as standard clauses or binding corporate rules.NIST Privacy FrameworkCT.PO-P2
- Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the countries of origin and final destination, the purposes and period of the intended processing, the law in force and international obligations there, any enforceable codes of conduct, and the security measures taken in that country or territory.NIST Privacy FrameworkID.DE-P2
- Submit any binding corporate rules you rely on to the Commissioner for authorisation, and make them specify what section 25 requires, including the data subjects' rights and how to exercise them, the acceptance of liability, the complaint procedures and the compliance-verification mechanisms.NIST Privacy FrameworkCT.PO-P2
- Where you rely on a derogation in section 26 instead, make sure it is one the section lists, such as the data subject's consent, contractual necessity, substantial public interest, legal proceedings, vital interests, a public register, or terms approved or a transfer authorised by the Commissioner.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 25(1)(j) requires binding corporate rules to contain mechanisms for verifying compliance, (k) mechanisms for reporting and recording changes to the rules and reporting them to the supervisory authority, and (l) cooperation including making the results of the verifications available to the supervisory authority or the Commissioner. The record is a verification result and a change record, and the duty attaches only when a group transfers on binding corporate rules, for which the Act states no interval. Sections 22 to 24, 26 and 27 on adequacy, safeguards and derogations contain no record duty, and section 26 has no counterpart of the GDPR Article 49(6) duty to document a derogation assessment.
- Kind
- Implicit
- As of
- Provision
- Section 25(1)(j) to (l) (binding corporate rules provide for verification of compliance, for recording changes to the rules and for making verification results available to the Commissioner)
- Trigger
- personal_data_processing
What this law does
Section 22 bars the transfer of personal data to a country or territory outside Barbados unless that country or territory provides an adequate level of protection for the rights and freedoms of data subjects and appropriate safeguards, on condition that the data subject's rights are enforceable and effective legal remedies are available.
Section 23 makes adequacy a question of all the circumstances, weighing the nature of the data, the country of origin and of final destination, the purposes and period of the intended processing, the law in force and international obligations of that country, any enforceable codes of conduct and the security measures taken there.
Section 24 lists the appropriate safeguards: a legally binding and enforceable instrument between public authorities, binding corporate rules under section 25, standard data protection clauses prescribed by the Commissioner with the Minister's approval, contractual clauses the Commissioner authorises, and authorised provisions in administrative arrangements between public authorities.
Section 25 sets out what binding corporate rules must specify and requires them to be submitted to the Commissioner for authorisation. Section 26 lists the derogations that displace sections 22 to 24, including the data subject's consent, contractual necessity, substantial public interest, legal proceedings or advice, vital interests, a public register, and terms approved or a transfer authorised by the Commissioner.
Section 27 makes contravening sections 22, 23 or 24 an offence carrying, on summary conviction, a fine of $500,000 or three years' imprisonment or both, and section 28 lets the Minister specify by order when a transfer is to be treated as necessary for reasons of substantial public interest. Section 100 leaves commencement to a proclamation.
The Official Gazette of carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .