BahamasData Protection Act, 2025, enforcement and penalties
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Data Protection Commissioner
- Obligation class
- Access restriction, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Comply with an enforcement notice the Data Protection Commissioner serves, by taking or refraining from the steps it specifies, or refraining from processing the personal data it describes or processing it for the purpose or in the manner it specifies, within the time it specifies, noting that the notice may not require compliance before the appeal period ends unless it states a case of urgency.
- Provide the information an information notice requires, in the form and within the period it specifies, except information that would expose you to proceedings for an offence other than one under the Act or for perjury, and communications with counsel and attorney that section 77(6) protects.
- Do not make a statement you know to be false in a material respect, or recklessly make a statement that is false in a material respect, in purported compliance with an information notice or a request for assessment.
- Do not, knowingly or recklessly and without the data controller's consent, obtain or disclose personal data or the information it contains, or procure its disclosure to another person, unless an exception in section 96(2) applies.
- Do not sell, rent or offer to sell personal data obtained in contravention of section 96(1); an advertisement indicating that personal data is or may be for sale is an offer to sell it.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80(1): failing to comply with an enforcement notice, an information notice or a request for assessment is an offence. Section 80(4): a person who commits an offence under section 80(1) or (2) is liable upon summary conviction to a fine of fifty thousand dollars or to a term of imprisonment of three years, or to both.
Penalty structure
The highest fine in these sections is the one hundred thousand dollars section 96(4) sets on summary conviction for selling, renting or offering to sell personal data obtained in contravention of section 96(1), with imprisonment not exceeding five years, or both. Section 80(4) sets a fine of fifty thousand dollars or imprisonment of three years, or both, and section 96(3) a fine not exceeding fifty thousand dollars or imprisonment not exceeding three years, or both. A penalty notice under section 90(1) is a civil amount not exceeding ten thousand dollars.
- Rule
- Fixed only
- As of
- Currency
- BSD
- Fixed cap
- 100,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 74 to 77, 80, 90 and 94 to 96 let the Commissioner serve enforcement and information notices and issue penalty notices, and make failure to comply and unlawful obtaining or disclosure of personal data offences. They state no duty to create or keep a log, register or record, and no retention period; the information notice reaches information about the processing and documentation of personal data that already exists.
- Kind
- None
- As of
What this law does
The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions. The Act establishes the Office of the Data Protection Commissioner, which shall be responsible for the regulation and enforcement of data protection and privacy.
Where the Commissioner is satisfied that a data controller has contravened the Act, the Commissioner may serve an enforcement notice requiring the data controller to take or refrain from taking specified steps, or to refrain from processing specified personal data or processing it for a specified purpose or in a specified manner. A person on whom an enforcement notice or an information notice has been served may appeal to the Tribunal against it.
Where an appeal is brought against an enforcement notice, the person upon whom it is served is not required to comply with it pending the determination or withdrawal of the appeal.
The Commissioner may serve a data controller or data processor with an information notice requiring it to provide specified information where the Commissioner reasonably requires any information for the purpose of determining whether the data controller or data processor has complied or is complying with the data protection principles in Part II of the Act. A person commits an offence where the person fails to comply with an enforcement notice, an information notice or a request for assessment.
A person who commits an offence under section 80(1) or (2) is liable upon summary conviction to a fine of fifty thousand dollars or to a term of imprisonment of three years, or to both. A person commits an offence if, in purported compliance with an information notice or request for assessment, the person makes a statement which the person knows to be false in a material respect, or recklessly makes a statement which is false in a material respect.
Where the Commissioner is satisfied that a person has failed or is failing to comply with section 42(2), 43(2), 44, 46, 48, 49, 51, or 53, the Commissioner may issue a penalty notice where he considers it to be in the public interest. A penalty notice issued under section 90(1) has the same force and effect as if the penalty notice was a judgment of the Supreme Court. A person aggrieved by a penalty notice may appeal to the Tribunal within twenty-eight days of the date of the order.
A person shall not knowingly or recklessly, without the consent of the data controller, obtain or disclose personal data or the information contained in personal data, or procure the disclosure to another person of the information contained in personal data. A person who contravenes section 96(1) commits an offence and is liable on summary conviction to a fine not exceeding fifty thousand dollars or to a term of imprisonment not exceeding three years, or to both.
A person who sells, rents or offers to sell personal data commits an offence if the person obtained the personal data in contravention of section 96(1), and is liable on summary conviction to a fine not exceeding one hundred thousand dollars or a term of imprisonment not exceeding five years, or to both.
Where an offence under the Act has been committed by a body corporate with the consent or connivance of, or through neglect on the part of, a director, manager, secretary or other officer of the body corporate, that person and the body corporate are guilty of the offence. Proceedings for an offence under the Act shall not be instituted except by the Director of Public Prosecutions or by the Commissioner with the consent of the Director of Public Prosecutions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .