BahamasData Protection Act, 2025, comprehensive regime as enacted
Data Protection Act 2025 (No. 74 of 2025), Laws of The Bahamas, assented , repealing the Data Protection (Privacy of Personal Information) Act, Ch. 324A
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Do not subject a data subject to a decision based solely on automated data processing or profiling that produces legal effects concerning, or similarly affects, the data subject, unless the decision is necessary for a contract between you and the data subject, authorized by a written law that specifies suitable safeguards, or based on the data subject's consent; where you rely on the contract or consent exception, implement suitable measures to safeguard the data subject's fundamental rights and freedoms.
- Do not transfer personal data to a country, territory or international organization that does not ensure an adequate level of protection for the fundamental rights and freedoms of data subjects.
- Keep a written or electronic record of the data processing activities under your responsibility and make it available to the Commissioner on request.
- Notify the Commissioner within seventy-two hours of becoming aware of a personal data breach likely to result in a risk to an identifiable natural person or involving the unauthorized disclosure of sensitive personal data.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 54(2): a transfer of personal data outside The Bahamas in contravention of section 54 is an offence punishable on summary conviction by a fine not exceeding fifty thousand dollars, imprisonment not exceeding three years, or both.
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 44(1) requires a data controller to keep and maintain, in writing or by electronic means, a record of the data processing activities under its responsibility, with the contents listed in section 44(2); section 44(3) requires the controller to make the records available to the Commissioner on request.
- Kind
- Explicit
- As of
- Provision
- s. 44
- Trigger
- all_systems
What this law does
The Data Protection Act, 2025 (Act 74 of 2025) bears the date of assent and replaces the Data Protection (Privacy of Personal Information) Act, Chapter 324A, which section 101 repeals. The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed for different provisions.
It applies to processing in the context of the activities of a data controller or data processor established in The Bahamas, and to the processing of personal data of data subjects in The Bahamas by one not established there where it uses equipment in The Bahamas or the processing relates to offering goods or services to those data subjects or monitoring their behaviour within The Bahamas.
Section 50 provides that no data subject shall be subject to a decision based solely on automated data processing or profiling which produces legal effects concerning the data subject or similarly affects the data subject. Section 50 does not apply to a decision that is necessary for entering into or performing a contract, authorized by a written law that specifies suitable safeguards, or based on the data subject's consent.
The Act defines profiling as any form of automated processing of personal data, including processing involving the use of artificial intelligence or other algorithmic techniques, that uses personal data to evaluate personal aspects of an identifiable natural person.
Section 54 bars the transfer of personal data to a country, territory or international organization that does not ensure an adequate level of protection, and makes a transfer in contravention an offence punishable on summary conviction by a fine not exceeding fifty thousand dollars, imprisonment not exceeding three years, or both.
A data controller must notify the Commissioner within seventy-two hours of becoming aware of a personal data breach that is likely to result in a risk to the rights, reputation or legitimate interests of an identifiable natural person or involves the unauthorized disclosure of sensitive personal data.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.