Barbados

Section 63(1) requires a data controller, where there is a personal data breach, to notify it to the Commissioner without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and section 63(2) requires a notification made outside that period to be accompanied by reasons for the delay.

Section 63(3) requires a data processor to notify the data controller without undue delay after becoming aware of a personal data breach.

Section 63(4) fixes what the notification must describe: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data privacy officer or other contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its adverse effects, with information given in phases without undue further delay where it cannot all be supplied at once.

Section 63(6) requires the controller to document every personal data breach, its facts, effects and remedial action, so the Commissioner can assess compliance.

Section 64(1) requires the controller to communicate a breach likely to result in a high risk to the rights and freedoms of individuals to the data subject without undue delay and, where feasible, not later than 72 hours after having become aware of it, in clear and plain language, and section 64(3) excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures have made the high risk no longer likely to materialise, or where it would involve disproportionate effort and a public communication of equal effect is made instead.

Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

Section 3 applies the Act to processing personal data in the context of the activities of a data controller or data processor established in Barbados, and to processing the personal data of data subjects in Barbados by a controller or processor not established there where the activities relate to offering goods or services to them.

Section 4 sets the processing principles, requiring personal data to be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, adequate, relevant and limited to what those purposes need, accurate and kept up to date, kept in identifiable form no longer than the purpose requires, and processed with appropriate security using technical or organisational measures. Sections 5 to 7 govern fairness, lawfulness and the conditions for valid consent.

Sections 29 to 49 carry the exemptions, from national security and crime through journalism, research, legal privilege and examinations. Section 50 bars operating as a data controller without registration in the Register of Data Controllers and requires a controller not established in Barbados to nominate a representative there; section 55 imposes the same on a data processor.

Section 54 requires data protection by design and by default, section 60 requires records of processing activities, section 62 requires technical and organisational measures giving a level of security appropriate to the risk, including pseudonymisation and encryption, the ability to restore availability and access after a physical or technical incident, and a process for regularly testing their effectiveness.

Section 65 requires a data protection impact assessment before processing likely to result in a high risk, section 66 requires prior consultation with the Commissioner, and sections 67 to 69 govern the designation, position and duties of the data privacy officer. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

Section 22 bars the transfer of personal data to a country or territory outside Barbados unless that country or territory provides an adequate level of protection for the rights and freedoms of data subjects and appropriate safeguards, on condition that the data subject's rights are enforceable and effective legal remedies are available.

Section 23 makes adequacy a question of all the circumstances, weighing the nature of the data, the country of origin and of final destination, the purposes and period of the intended processing, the law in force and international obligations of that country, any enforceable codes of conduct and the security measures taken there.

Section 24 lists the appropriate safeguards: a legally binding and enforceable instrument between public authorities, binding corporate rules under section 25, standard data protection clauses prescribed by the Commissioner with the Minister's approval, contractual clauses the Commissioner authorises, and authorised provisions in administrative arrangements between public authorities.

Section 25 sets out what binding corporate rules must specify and requires them to be submitted to the Commissioner for authorisation. Section 26 lists the derogations that displace sections 22 to 24, including the data subject's consent, contractual necessity, substantial public interest, legal proceedings or advice, vital interests, a public register, and terms approved or a transfer authorised by the Commissioner.

Section 27 makes contravening sections 22, 23 or 24 an offence carrying, on summary conviction, a fine of $500,000 or three years' imprisonment or both, and section 28 lets the Minister specify by order when a transfer is to be treated as necessary for reasons of substantial public interest. Section 100 leaves commencement to a proclamation.

The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

Section 18(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Section 18(2) excepts a decision necessary for entering into or performing a contract with the data subject, one authorised by an enactment that lays down suitable safeguards, or one based on the data subject's consent.

Where the contract or consent exception is relied on, section 18(3) requires the controller to implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, and section 18(4) bars the exceptions from reaching sensitive personal data unless the processing is in the public interest and those safeguards are in place.

Section 10 gives a data subject the right to be told by a data controller whether personal data about them is being processed and to obtain a copy of it, section 11 a right to rectification, section 12 a right to erasure, section 13 a right to restriction of processing and section 14 a duty on the controller to notify recipients of a rectification, erasure or restriction.

Section 15 gives a right to data portability, section 16 a right to prevent processing likely to cause damage or distress, and section 17 an unqualified right to prevent processing for the purposes of direct marketing.

Sections 19 and 20 fix the information a controller must give when it collects personal data from the data subject and when it obtains the data elsewhere, and section 21 requires that information and every communication about these rights to be transparent and to be provided in a form that lets the data subject exercise them. Section 100 leaves commencement to a proclamation.

The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

Sections 70 to 75 establish the Data Protection Commissioner and set the Commissioner's functions, staff, duties of confidence, indemnity and reporting.

Section 76 lets the Commissioner, on being satisfied that a data controller or data processor has contravened or is contravening the Act, serve an enforcement notice requiring steps to be taken or refrained from within a specified time, or requiring processing to stop, having considered whether the contravention has caused or is likely to cause damage or distress; sections 77 to 82 govern cancellation of a notice, requests for assessment, information notices, special information notices and the journalism restriction.

Section 83 makes failure to comply with a notice an offence, and sections 84 to 89 govern service, warrants, their execution and return, matters exempt from inspection and seizure, and obstruction. Sections 90 to 92 establish the Data Protection Tribunal and the right of appeal against the Commissioner's notices and its determination.

Section 93 entitles an individual who suffers damage or distress from any contravention of the Act to compensation from the data controller or data processor, subject to the defence of having taken all measures reasonably required to comply.

Section 94 makes it an offence to obtain, disclose or procure the disclosure of personal data knowingly or recklessly without the data controller's consent, carrying a fine of $10,000 or six months' imprisonment or both, rising to $100,000 or three years where the personal data so obtained is sold or offered for sale.

Section 95 lets the Commissioner, after a hearing and where the public interest calls for it, order a person who has contravened section 52(1), section 57(1) or sections 60 to 67 to pay the Crown a penalty of up to $50,000. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

Section 8 makes the processing of a child's personal data lawful only where and to the extent that consent is given or authorised by the child's parent or guardian, and requires the data controller to make reasonable efforts to verify in such cases that the consent came from a parent or guardian, taking available technology into account; a child is a person under the age of 18.

Section 9 prohibits the processing of sensitive personal data, which the Act defines to include genetic data and biometric data alongside racial or ethnic origin, political opinions, religious beliefs, membership of a political body or trade union, sexual orientation or sexual life, financial record or position and criminal record, unless one of the grounds it lists applies: the data subject's consent; necessity for a right or obligation imposed on the controller by law in connection with employment; the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld; processing by a not-for-profit political, philosophical, religious or trade union body confined to its members and not disclosed onward without consent; data the data subject has deliberately made public; legal proceedings, legal advice or the establishment, exercise or defence of legal rights; the administration of justice; functions of Parliament, of a public authority or conferred by an enactment; medical purposes undertaken by a health care professional or someone under an equivalent duty of confidentiality; and equality monitoring by racial or ethnic origin carried out with appropriate safeguards.

Section 9(2) lets the Minister by order specify further circumstances in which sensitive personal data may be processed. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.

Section 4 prohibits a person, knowingly or recklessly and without lawful excuse or justification, from gaining access to the whole or any part of a computer system, causing a programme to be executed, using a programme to gain access to data, copying or moving data, or altering or erasing it. The offence carries a fine of $25,000 or imprisonment of up to two years, or both.

Section 3(2) separately defines access as unauthorised only where the person is not entitled to it, lacks permission, or exceeds the permission granted; because section 4 does not itself require defeating a security measure, whether a person reading a public, unauthenticated page (which the site operator has made generally available) acts without lawful excuse is an open textual question that no reported Barbadian decision has settled.

Section 51 excuses fair dealing with a literary, dramatic, musical, or artistic work for research or private study from infringement, and section 52 separately excuses fair dealing for criticism or review, and for reporting current events, if accompanied by sufficient acknowledgment.

Section 53 directs a court to weigh the nature of the work, the extent used relative to the whole, the purpose and character of the use, and the effect on the work's market or value, so training a model on scraped copyrighted text under section 51 depends on characterising the use as research and satisfying those factors. The Act defines a literary work to include a written table or compilation, so a compiled database is protected only as an ordinary literary work if original.

The Act applies to processing personal data by a controller or processor established in Barbados, or targeting data subjects in Barbados, and carries no general exemption for personal data that is already publicly accessible; the only public-data exemption is narrow, covering information a controller is itself obliged by another enactment to publish.

A scraper collecting personal data, including a face or other biometric identifier, from a public Barbadian website remains subject to the Act's lawful-basis and purpose-limitation duties, and biometric data is sensitive personal data whose processing is prohibited unless a specific ground applies. Moving scraped personal data outside Barbados requires an adequate level of protection in the destination country or an appropriate safeguard.

The Financial Services Commission's Technology and Cyber Risk Management Guideline says it was issued on December 1, 2024 pursuant to section 53 of the Financial Services Commission Act, 2010. The Guideline applies to all financial institutions the Commission regulates. The Guideline says it is effective December 1, 2024. The Guideline says senior management is required to establish the technology and cyber risk management framework and strategy.

The Guideline says a financial institution should carry out penetration testing after a vulnerability assessment has been conducted. The Guideline says documentation of the areas of a cybersecurity program needing improvement must be available for inspection by the Commission. Section 53 of the Financial Services Commission Act, 2010 lets the Commission issue guidelines after consultation with financial institutions.

Section 8 of the Act lets the Commission give directives to ensure compliance with the guidelines. Section 9 of the Act makes a person to whom a directive is given liable on summary conviction to a fine of $20 000 or to imprisonment for a term of 1 year or to both for failing to comply with it. Section 25 of the Act lets the Commission revoke a licence or cancel a registration where a financial institution has committed a serious breach of the guidelines.

The Central Bank of Barbados Technology and Cyber Risk Management Guideline, in the version of March 2026, is applicable to all entities licensed under the Financial Institutions Act and to payment service providers as defined under section 2 of the National Payment System Act, 2021. The Guideline says it contains both advisory and obligatory requirements.

The Bank says it issued the Guideline in furtherance of its responsibilities for the regulation and supervision of entities under the Financial Institutions Act and section 2 of the National Payment System Act, 2021. The Guideline says regulated entities must establish IT policies, standards and procedures to manage technology and cyber risks and safeguard information system assets in line with current industry standards.

The Guideline says all regulated entities must establish an information security policy based on the regulated entity's risk assessment. The Guideline says regulated entities must conduct penetration testing prior to the commissioning of a new system which offers internet accessibility and open network interfaces. The Guideline says regulated entities must establish and maintain a comprehensive testing program that covers both business continuity and incident response.

Section 54 of the National Payment System Act, 2021 makes a person that breaches a guideline or directive under that Act liable to an administrative measure. The administrative measures include an administrative penalty of up to $250 000 for the infringement and a fine not exceeding $25 000 for each day that the infringement continues.

Section 4 of the National Payment System Act, 2021 provides that the Central Bank shall, among other things, issue directives, instructions and guidelines for the operation of the National Payment Systems.

The Central Bank of Barbados Technology and Cyber Risk Management Guideline, in the version of March 2026, is applicable to all entities licensed under the Financial Institutions Act and to payment service providers as defined under section 2 of the National Payment System Act, 2021. The Guideline says it contains both advisory and obligatory requirements.

The Bank says it issued the Guideline in furtherance of its responsibilities for the regulation and supervision of entities under the Financial Institutions Act and section 2 of the National Payment System Act, 2021. The Guideline says an incident must be classified within the first twenty-four (24) hours of its detection.

The Guideline says regulated entities must complete the stage 1 section of the Initial report template and submit it to the Bank within four (4) hours after an incident is classified as major. The Guideline says the Bank must be contacted promptly pending the report template where a matter is classified as major within twenty-four hours or reaches the media or social platforms.

Section 54 of the National Payment System Act, 2021 makes a person that breaches a guideline or directive under that Act liable to an administrative measure. The administrative measures include an administrative penalty of up to $250 000 for the infringement and a fine not exceeding $25 000 for each day that the infringement continues.

Section 4 of the National Payment System Act, 2021 provides that the Central Bank shall, among other things, issue directives, instructions and guidelines for the operation of the National Payment Systems.

The Financial Services Commission's Technology and Cyber Risk Management Guideline says it was issued on December 1, 2024 pursuant to section 53 of the Financial Services Commission Act, 2010. The Guideline applies to all financial institutions the Commission regulates. The Guideline says it is effective December 1, 2024.

Section 10 of the Guideline says financial institutions should inform the Commission within four hours after an incident is classified, and that an incident should be classified within the first twenty-four hours of its detection.

The Commission's instructions for completing the cyber incident reporting forms say the initial report should be submitted within four hours from the moment the incident has been classified as high or critical and within twenty-four hours for incidents classified as low or medium. The instructions say that if the incident has not been resolved 5 days after the submission of the Initial Report the financial institution is required to populate the Intermediate Report Form.

The instructions say financial institutions should deliver the final report to the Commission within twenty working days after business is deemed back to normal. The Commission's Information Circular of April 2025 says financial institutions are required to notify the Commission of all reportable cyber incidents and also to report unsuccessful attempts of any cyber incidents.

The Guideline says failure to report incidents to the Commission may result in increased supervisory oversight, including enhanced monitoring, watch-listing or staging of the financial institution under the Commission's ladder of intervention. Section 53 of the Financial Services Commission Act, 2010 lets the Commission issue guidelines after consultation with financial institutions. Section 8 of the Act lets the Commission give directives to ensure compliance with the guidelines.

Section 9 of the Act makes a person to whom a directive is given liable on summary conviction to a fine of $20 000 or to imprisonment for a term of 1 year or to both for failing to comply with it. Section 25 of the Act lets the Commission revoke a licence or cancel a registration where a financial institution has committed a serious breach of the guidelines.

Section 52(1)(b) excuses fair dealing with a protected work, other than a photograph, for the purpose of reporting current events from infringing copyright, provided it is accompanied by a sufficient acknowledgment; no acknowledgment is required where the reporting is by sound recording, film, broadcast, or cable programme.

Section 53 requires a court to weigh the nature of the work, the extent used relative to the whole, the purpose and character of the use, and the effect on the work's market or value.