BahamasData Protection Act, 2025, data subject rights
Data Protection Act, 2025 (No. 74 of 2025), ss. 24-32 (data subject rights)
A data subject rights rule binding public and private bodies.
- Private right of action
- Yes
- Enforcement body
- Data Protection Commissioner
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Tell a data subject whether you are processing their personal data and, on a written request with the prescribed fee, give them the information section 24(1) lists, communicating in a clear, intelligent and unambiguous manner, within thirty days of the request and the fee or any other period regulations prescribe.
- Do not supply an access request in a way that discloses personal data relating to another data subject unless that data subject has consented or it is reasonable in all the circumstances to comply without the consent, and supply the part that can be supplied without identifying the other data subject.
- If you are a data processor and receive an access request for personal data you process for a data controller, inform the data subject of the right to make the request to the data controller.
- Rectify inaccurate personal data without undue delay, complete incomplete personal data through a supplementary statement, and communicate the rectification to each recipient unless that proves impossible or involves disproportionate effort.
- Within twenty-one days of a data subject's written notice objecting under section 27(1), stop the processing unless you demonstrate compelling legitimate grounds that override the data subject's fundamental rights and freedoms, or the processing is for the purpose of legal proceedings, and give the data subject your reasons if you refuse.
- Erase personal data without undue delay on a ground in section 28(2) (no longer necessary, consent withdrawn, objection, unlawful processing or a legal obligation), subject to the overrides in section 28(4), and communicate the erasure to each recipient unless that proves impossible or involves disproportionate effort.
- Restrict the processing of personal data when the data subject requires it on a ground in section 29(1), and process restricted personal data, apart from storage, only on a basis section 29(2) allows.
- Cease, or do not begin, processing personal data on a data subject's written notice where the processing is causing or is likely to cause substantial damage or distress that is unwarranted, except where section 30(2) disapplies the right.
- On request, give a data subject the personal data they provided to you in a structured, commonly used and machine-readable format and transmit it directly to another data controller where technically feasible, where the processing is based on consent or a contract and carried out by automated means.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 24 to 32 give a data subject rights of access, complaint, rectification, objection, erasure, restriction, prevention of processing, portability and compensation. They state no duty to create or keep a log, register or record, no audit and no retention period, and carry no territorial hook of their own.
- Kind
- None
- As of
What this law does
The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions. A data subject must be informed by a data controller whether personal data of the data subject is being processed by or on behalf of the data controller. A data controller is not obliged to supply personal data under section 24 unless it has received a request in writing and the prescribed fee.
A data controller must comply with an access request within thirty days, or another period prescribed by regulations, of the date on which it receives the request and the fee. A data subject may file a complaint with the Commissioner if the data subject considers that the processing of personal data by a data controller contravenes the Act.
A data subject has the right to obtain from the data controller, without undue delay, the rectification of inaccurate personal data concerning the data subject. A data subject may at any time, by notice in writing to a data controller, object on grounds relating to the data subject's particular situation to the processing and profiling of personal data under section 6(1)(b)(iv) and (v).
The data controller must comply with such a notice within twenty-one days of receiving it unless the data controller demonstrates compelling legitimate grounds for the processing which override the fundamental rights and freedoms of the data subject, or the processing is for the purpose of legal proceedings. A data controller must erase personal data without undue delay where the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
A data subject has the right to require the data controller to restrict the processing of the personal data of the data subject if the accuracy of the personal data is contested by the data subject. A data subject has the right to receive the personal data concerning the data subject which the data subject has provided to a data controller in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance.
The right to receive and transfer personal data applies where the processing is based on the data subject's consent or on a contract to which the data subject is a party and is carried out by automated means. A data subject who has suffered material damage as a result of a breach of the data subject's rights under the Act may commence proceedings in the Supreme Court against the data controller or data processor to recover compensation for the damage suffered.
A data controller or data processor is not liable in such proceedings if it proves that it took all reasonable steps and exercised all due diligence to comply with the Act.
When LexLint raises it
When your app profile says your app processes personal data or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .