BahamasData Protection Act, 2025, personal data breach notification
Data Protection Act, 2025 (No. 74 of 2025), ss. 48-49 (personal data breach notification)
A breach notification rule binding public and private bodies.
- Enforcement body
- Data Protection Commissioner
- Obligation class
- Breach notice, Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Notify the Data Protection Commissioner within seventy-two hours of becoming aware of a personal data breach that is likely to result in a risk to the fundamental rights and freedoms, reputation, or other legitimate interests of an identifiable natural person, or that involves the unauthorized disclosure of sensitive personal data, and treat a breach as likely to result in a risk where it involves sensitive categories of personal data, could cause humiliation, harm, distress, reputational damage or economic loss to a data subject, or exposes personal data to unauthorized access, use or disclosure.
- If the notification is not made to the Commissioner within seventy-two hours, give the Commissioner the reasons for the delay.
- If you are a data processor, notify the data controller within seventy-two hours after having become aware of a breach of personal data.
- In the notification, describe the nature of the breach, specify its categories, the number of data subjects affected and the categories and number of personal data records affected, give the name and contact details of the data protection officer or other contact point, and describe the consequences of the breach, the measures taken or proposed to address it and the measures to mitigate its adverse effects; if all of this cannot be provided at once, provide it in phases within seven working days or an extended time as prescribed.
- Record every breach of personal data, describing the facts relating to the breach, its effects and the remedial action taken.
- Communicate a breach to the affected data subject within seventy-two hours after having become aware of it, in clear and plain language, where it is likely to result in the violation of the data subject's fundamental rights and freedoms or the unauthorized disclosure of the data subject's sensitive personal data, unless a condition in section 49(3) is satisfied.
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Section 90(1) lets the Commissioner issue a penalty notice, where he considers it to be in the public interest, for failure to comply with section 48 or 49 among other sections, requiring payment of an amount not exceeding ten thousand dollars.
- Rule
- Fixed only
- As of
- Currency
- BSD
- Fixed cap
- 10,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 48(7) requires a data controller to record every breach of personal data and to describe in the record the facts relating to the breach, its effects and the remedial action taken, in order to facilitate the assessment by the Commissioner of the controller's compliance with the section. The section names no retention period.
- Kind
- Explicit
- As of
- Provision
- s. 48(7)
- Trigger
- security_incident
What this law does
The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions.
A data controller must notify the Commissioner, within seventy-two hours of becoming aware of a personal data breach, where the breach is likely to result in a risk to the fundamental rights and freedoms, reputation, or other legitimate interests of an identifiable natural person, or involves the unauthorized disclosure of sensitive personal data.
A data breach is automatically deemed likely to result in a risk where it involves sensitive categories of personal data, could cause humiliation, harm, distress, reputational damage, or economic loss to a data subject, or exposes personal data to unauthorized access, use, or disclosure. Where the notification is not made to the Commissioner within seventy-two hours, the data controller must provide reasons for the delay to the Commissioner.
A data processor must notify the data controller within seventy-two hours after having become aware of a breach of personal data. The notification must describe the nature of the breach, specify the categories of the breach, specify or estimate the number of data subjects affected, and specify the categories and number of personal data records affected.
Where it is not possible to provide all the required information at the same time, the information may be provided in phases within seven working days or within an extended time as prescribed. The data controller must record every breach of personal data and describe in the record the facts relating to the breach, the effects of the breach, and the remedial action taken, in order to facilitate the assessment by the Commissioner of compliance with the section.
Where a breach of personal data is likely to result in the violation of the fundamental rights and freedoms of a data subject or the unauthorized disclosure of an identifiable natural person's sensitive personal data, the data controller must communicate the breach to the data subject within seventy-two hours after having become aware of the breach.
Communication of the breach to the data subject is not required where the data controller has implemented technical and organizational measures which render the personal data affected by the breach unintelligible to a person who is not authorized to access it.
Communication of the breach to the data subject is also not required where the notification would involve a disproportionate effort due to the number of data subjects affected, and a public communication or similar measure would be an effective method of notification. The Commissioner may issue a penalty notice to a person who has failed or is failing to comply with section 48 or 49, where the Commissioner considers it to be in the public interest. The amount payable under a penalty notice may not exceed ten thousand dollars.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .