BahamasData Protection Act 2003, cross-border transfer of personal data
Data Protection (Privacy of Personal Information) Act Ch. 324A, Laws of The Bahamas, s. 17 (prohibition on transfer of personal data outside The Bahamas)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2003/2003-0003/2003-0003.pdfIn force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Before transferring personal data collected in The Bahamas to another country, be prepared to show the recipient provides protection equivalent to this Act if the Data Protection Commissioner questions the transfer.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing or refusing, without reasonable excuse, to comply with a prohibition notice served under section 17 is an offence, prosecuted under the Act's general penalty provision (section 29).
What it makes you log
Logging duty
Section 17 lets the Data Protection Commissioner prohibit a transfer of personal data from The Bahamas to a place outside it where the recipient does not provide equivalent protection, by a prohibition notice that the affected person may appeal. It states no duty to record or log a transfer, no audit and no retention period, and has no territorial hook of its own.
- Kind
- None
- As of
What this law does
The Data Protection Commissioner may prohibit a proposed transfer of personal data from The Bahamas to a place outside it where the recipient fails to provide protection, by contract or otherwise, equivalent to the Act's, having regard to the desirability of facilitating international data transfers and the risk of damage or distress to any person.
The prohibition is served by a written prohibition notice against which the affected person may appeal to the Supreme Court, and failing or refusing to comply with a prohibition notice without reasonable excuse is an offence.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .