BahamasData Protection Act, 2025, transfer of personal data outside The Bahamas
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- The Act applies only from the date or dates the Minister appoints by notice in the Gazette; read the lines below as what applies once the relevant provisions are brought into operation.
- Do not transfer personal data to a country, territory or international organization unless it ensures an adequate level of protection for the fundamental rights and freedoms of data subjects in relation to the processing of personal data, judged in all the circumstances of the case, having regard to the nature of the data, its origin and final destination, the purposes and period of processing, the applicable laws and international obligations of the recipient, any enforceable codes of conduct and the security measures taken there.
- If you rely on section 55 for a transfer of personal data outside The Bahamas, make sure one of its conditions is met: the data subject consents; the transfer is necessary for a contract with the data subject, for a contract concluded in the data subject's interest, for a matter of public interest the Minister specifies by order, for a legal claim, to protect the data subject or others where the data subject cannot consent, or for your compelling legitimate interests not overridden by the data subject's rights; or the data is part of the personal data on the public register and the register's conditions of inspection are complied with.
- Within one year after the Act commences, review your arrangements for the storage or processing of personal data by third parties, inside or outside The Bahamas, and the contracts or other mechanisms governing the cross-border transfer or storage of personal data, in a manner proportionate to the nature, scope and volume of the personal data and the risks to data subjects.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 54(2): a transfer of personal data outside The Bahamas in contravention of section 54 is an offence punishable on summary conviction by a fine not exceeding fifty thousand dollars, imprisonment not exceeding three years, or both.
Penalty structure
Section 54(2) caps the fine for a transfer in contravention of section 54 at fifty thousand dollars on summary conviction; the same offence also carries imprisonment not exceeding three years, or both.
- Rule
- Fixed only
- As of
- Currency
- BSD
- Fixed cap
- 50,000
What it makes you log
Logging duty
Sections 54 to 56 bar transfers to a place without adequate protection, list the conditions on which a transfer is permitted, and require a review, within one year after commencement, of existing third-party and cross-border arrangements. They state no duty to keep a log or a record of transfers, no audit and no retention period, and carry no territorial hook of their own.
- Kind
- None
- As of
What this law does
The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions. Personal data shall not be transferred to a country, territory or international organization unless that country, territory or international organization ensures an adequate level of protection for the fundamental rights and freedoms of data subjects in relation to the processing of personal data.
A person who transfers data to a country or territory outside of The Bahamas in contravention of section 54 commits an offence and is liable on summary conviction to a fine not exceeding fifty thousand dollars or to a term of imprisonment not exceeding three years, or to both. Section 54(3) defines an adequate level of protection as protection that is adequate in all the circumstances of the case, having regard in particular to the nature of the personal data and the other matters it lists.
Personal data may be transferred outside of The Bahamas where the data subject consents to the transfer. Personal data may also be transferred where the transfer is necessary for the performance of a contract between the data subject and the data controller or implementation of pre-contractual measures taken at the request of the data subject. Personal data may also be transferred where the transfer is necessary for the establishment, exercise or defence of a legal claim.
Within one year after the commencement of the Act, every data controller must review any existing arrangements for the storage or processing of personal data by third parties, whether within or outside The Bahamas, and the contracts or other mechanisms governing the cross-border transfer or storage of personal data, to ensure compliance with the requirements for the transfer of personal data under that Part.
The Minister may, on the recommendation of the Commissioner, make regulations providing for exemptions for certain categories of data controllers or data processors from the principles for transfer of personal data outside The Bahamas under section 54.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .