BahamasData Protection Act, 2025, sensitive personal data
Data Protection Act, 2025 (No. 74 of 2025), ss. 2(1), 35-36 (sensitive personal data)
A sensitive categories rule binding public and private bodies.
- Obligation class
- Biometric, Consent
- Audit expectation
- none
What it requires
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Do not process sensitive personal data (racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, genetic data, biometric data used to identify a person uniquely, sex life or sexual orientation, medical data, health records, financial records or financial position, a criminal record or offence proceedings) without the data subject's consent in writing, unless an exception in section 35(2), (4), (5) or (6), or an order under section 35(7), applies.
- Process sensitive personal data relating to health only with the data subject's consent and by or under the responsibility of a health care professional or by a person bound by professional secrecy under a written law, unless section 36(2) applies.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 2 defines sensitive personal data, and sections 35 and 36 set the conditions for processing it, the first being the data subject's consent in writing. A consent required in writing is a condition of processing, and the sections do not say the controller must keep, show or produce a record of it. They state no audit and no retention period, and carry no territorial hook of their own.
- Kind
- None
- As of
What this law does
The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions.
Sensitive personal data means personal data consisting of information on a data subject's racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, trade union membership, genetic data, biometric data for the purpose of uniquely identifying an identifiable natural person, sex life or sexual orientation, medical data, health record, financial record or financial position, criminal record, or proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of the proceedings or the sentence of any court of competent jurisdiction in the proceedings.
Section 35(1) provides that the sensitive personal data of a data subject shall not be processed without the consent in writing of the data subject. Section 35(2)(a) permits processing where the sensitive personal data is necessary for the purposes of exercising or performing a right, or obligation, conferred or imposed by a written law on the data controller, in connection with the employment of the data subject.
Section 35(4) permits processing where it is necessary in order to protect the vital interests of the data subject or another person, in a case where consent cannot be given by or on behalf of the data subject. Sensitive personal data of a data subject may be processed where the information it contains has been made public as a result of steps taken by the data subject.
Sensitive personal data relating to the health of a data subject may only be processed with the consent of the data subject and by or under the responsibility of a health care professional, or by a person subject to the obligation of professional secrecy under a written law. Section 36(2) allows health data to be processed, without those conditions, where the processing is necessary for reasons of public interest in the area of public health.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .