BahamasData Protection Act 2003, application and processing principles
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2003/2003-0003/2003-0003.pdfIn force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Collect personal data only by means that are lawful and fair, keep it accurate and up to date, and hold it only for the specified purposes it was collected for.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCT.PO-P2
- Give an individual access to personal data held about them within forty days of a written request, and rectify or erase it on request where it breaches the collection principles.NIST Privacy FrameworkCT.PO-P3
- Stop using an individual's personal data for direct marketing within forty days of their written request.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 6 to 13 set the data protection principles and the rights of access, rectification and erasure: lawful and fair collection, accuracy, specified purposes, no longer than necessary, and appropriate security measures against unauthorised access, alteration, disclosure, destruction and accidental loss. Section 12(1) lets a controller be treated as complying with the accuracy principle where its data carry an indication of where the information came from and of any dispute by the data subject, which is a way to meet a duty and not a duty to keep a record. No section among them tells the controller to keep a log, a register or a record of processing. Section 4(1)(a) applies the Act to a controller established in The Bahamas for data processed in the context of that establishment; the second prong, a controller that uses equipment in The Bahamas, turns on where the processing equipment is and is left out of the hook.
- Kind
- None
- As of
What this law does
The Act binds a data controller established in The Bahamas, or one using equipment there to process data, to collect personal data by lawful and fair means, keep it accurate and up to date, hold it only for specified purposes, and secure it against unauthorised access. An individual may request access to personal data held about them within forty days. An individual may also have inaccurate data rectified or erased on written request.
An individual may require a controller to stop using their data for direct marketing. The Act does not apply to personal data kept for national security, information a controller is required by law to publish, an individual's own personal or household affairs, or pending legal proceedings.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .