Bahamas

Section 16A criminalises producing any child pornography, an offence liable to imprisonment for life, and separately criminalises receiving or disseminating child pornography for the purpose of distribution or sale, possessing child pornography, or intentionally causing or inciting a person under eighteen to be involved in pornography, each liable to imprisonment for twenty years.

Child pornography is defined as a photographic, film, video or other visual representation, whether or not it was made or transmitted by electronic or mechanical means, that shows a person who is, or is depicted as being, under eighteen engaged in explicit sexual activity, or whose dominant characteristic is the depiction of a sexual organ or the buttocks of a person under eighteen; the definition does not require the depicted person to be a real, identifiable individual, so a computer-generated or AI-synthesised depiction meeting it is capable of falling within the ban.

Section 16A was inserted by the Sexual Offences (Amendment) Act, 2008 (No. 29 of 2008). No commencement notice for that Act has been located in the Official Gazette.

The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions.

A data controller must notify the Commissioner, within seventy-two hours of becoming aware of a personal data breach, where the breach is likely to result in a risk to the fundamental rights and freedoms, reputation, or other legitimate interests of an identifiable natural person, or involves the unauthorized disclosure of sensitive personal data.

A data breach is automatically deemed likely to result in a risk where it involves sensitive categories of personal data, could cause humiliation, harm, distress, reputational damage, or economic loss to a data subject, or exposes personal data to unauthorized access, use, or disclosure. Where the notification is not made to the Commissioner within seventy-two hours, the data controller must provide reasons for the delay to the Commissioner.

A data processor must notify the data controller within seventy-two hours after having become aware of a breach of personal data. The notification must describe the nature of the breach, specify the categories of the breach, specify or estimate the number of data subjects affected, and specify the categories and number of personal data records affected.

Where it is not possible to provide all the required information at the same time, the information may be provided in phases within seven working days or within an extended time as prescribed. The data controller must record every breach of personal data and describe in the record the facts relating to the breach, the effects of the breach, and the remedial action taken, in order to facilitate the assessment by the Commissioner of compliance with the section.

Where a breach of personal data is likely to result in the violation of the fundamental rights and freedoms of a data subject or the unauthorized disclosure of an identifiable natural person's sensitive personal data, the data controller must communicate the breach to the data subject within seventy-two hours after having become aware of the breach.

Communication of the breach to the data subject is not required where the data controller has implemented technical and organizational measures which render the personal data affected by the breach unintelligible to a person who is not authorized to access it.

Communication of the breach to the data subject is also not required where the notification would involve a disproportionate effort due to the number of data subjects affected, and a public communication or similar measure would be an effective method of notification. The Commissioner may issue a penalty notice to a person who has failed or is failing to comply with section 48 or 49, where the Commissioner considers it to be in the public interest. The amount payable under a penalty notice may not exceed ten thousand dollars.

The Act binds a data controller established in The Bahamas, or one using equipment there to process data, to collect personal data by lawful and fair means, keep it accurate and up to date, hold it only for specified purposes, and secure it against unauthorised access. An individual may request access to personal data held about them within forty days. An individual may also have inaccurate data rectified or erased on written request.

An individual may require a controller to stop using their data for direct marketing. The Act does not apply to personal data kept for national security, information a controller is required by law to publish, an individual's own personal or household affairs, or pending legal proceedings.

The Data Protection Act, 2025 (Act 74 of 2025) bears the date of assent 9 December 2025 and replaces the Data Protection (Privacy of Personal Information) Act, Chapter 324A, which section 101 repeals. The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed for different provisions.

It applies to processing in the context of the activities of a data controller or data processor established in The Bahamas, and to the processing of personal data of data subjects in The Bahamas by one not established there where it uses equipment in The Bahamas or the processing relates to offering goods or services to those data subjects or monitoring their behaviour within The Bahamas.

Section 50 provides that no data subject shall be subject to a decision based solely on automated data processing or profiling which produces legal effects concerning the data subject or similarly affects the data subject. Section 50 does not apply to a decision that is necessary for entering into or performing a contract, authorized by a written law that specifies suitable safeguards, or based on the data subject's consent.

The Act defines profiling as any form of automated processing of personal data, including processing involving the use of artificial intelligence or other algorithmic techniques, that uses personal data to evaluate personal aspects of an identifiable natural person.

Section 54 bars the transfer of personal data to a country, territory or international organization that does not ensure an adequate level of protection, and makes a transfer in contravention an offence punishable on summary conviction by a fine not exceeding fifty thousand dollars, imprisonment not exceeding three years, or both.

A data controller must notify the Commissioner within seventy-two hours of becoming aware of a personal data breach that is likely to result in a risk to the rights, reputation or legitimate interests of an identifiable natural person or involves the unauthorized disclosure of sensitive personal data.

The Data Protection Commissioner may prohibit a proposed transfer of personal data from The Bahamas to a place outside it where the recipient fails to provide protection, by contract or otherwise, equivalent to the Act's, having regard to the desirability of facilitating international data transfers and the risk of damage or distress to any person.

The prohibition is served by a written prohibition notice against which the affected person may appeal to the Supreme Court, and failing or refusing to comply with a prohibition notice without reasonable excuse is an offence.

The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions. Personal data shall not be transferred to a country, territory or international organization unless that country, territory or international organization ensures an adequate level of protection for the fundamental rights and freedoms of data subjects in relation to the processing of personal data.

A person who transfers data to a country or territory outside of The Bahamas in contravention of section 54 commits an offence and is liable on summary conviction to a fine not exceeding fifty thousand dollars or to a term of imprisonment not exceeding three years, or to both. Section 54(3) defines an adequate level of protection as protection that is adequate in all the circumstances of the case, having regard in particular to the nature of the personal data and the other matters it lists.

Personal data may be transferred outside of The Bahamas where the data subject consents to the transfer. Personal data may also be transferred where the transfer is necessary for the performance of a contract between the data subject and the data controller or implementation of pre-contractual measures taken at the request of the data subject. Personal data may also be transferred where the transfer is necessary for the establishment, exercise or defence of a legal claim.

Within one year after the commencement of the Act, every data controller must review any existing arrangements for the storage or processing of personal data by third parties, whether within or outside The Bahamas, and the contracts or other mechanisms governing the cross-border transfer or storage of personal data, to ensure compliance with the requirements for the transfer of personal data under that Part.

The Minister may, on the recommendation of the Commissioner, make regulations providing for exemptions for certain categories of data controllers or data processors from the principles for transfer of personal data outside The Bahamas under section 54.

Section 8 of the Act gives an individual who makes a written request to a data controller a right to be informed whether the data kept include personal data relating to the individual. The individual is also entitled to be supplied with a copy of the information constituting any such data. Where any of the information is not intelligible to the average person without explanation, it must be accompanied by an explanation of those terms.

A refusal of an access request must be notified in writing, with a statement of the reasons for the refusal and an indication that the individual may complain to the Commissioner. On a written request, an individual is entitled to have rectified or, where appropriate, erased any such data in relation to which the controller has contravened section 6(1), and the controller must comply within forty days.

Where a data subject makes a written request for the controller to cease using, for the purpose of direct marketing, any data which was kept for that purpose, the controller must within forty days erase the data kept for that purpose or, if the data are kept for that purpose and other purposes, cease using the data for that purpose, and notify the data subject in writing.

Section 9 provides that the right of access does not apply to personal data kept for preventing, detecting or investigating an offence, or for assessing or collecting tax, in any case in which applying it would be likely to prejudice those matters.

The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions. A data subject must be informed by a data controller whether personal data of the data subject is being processed by or on behalf of the data controller. A data controller is not obliged to supply personal data under section 24 unless it has received a request in writing and the prescribed fee.

A data controller must comply with an access request within thirty days, or another period prescribed by regulations, of the date on which it receives the request and the fee. A data subject may file a complaint with the Commissioner if the data subject considers that the processing of personal data by a data controller contravenes the Act.

A data subject has the right to obtain from the data controller, without undue delay, the rectification of inaccurate personal data concerning the data subject. A data subject may at any time, by notice in writing to a data controller, object on grounds relating to the data subject's particular situation to the processing and profiling of personal data under section 6(1)(b)(iv) and (v).

The data controller must comply with such a notice within twenty-one days of receiving it unless the data controller demonstrates compelling legitimate grounds for the processing which override the fundamental rights and freedoms of the data subject, or the processing is for the purpose of legal proceedings. A data controller must erase personal data without undue delay where the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.

A data subject has the right to require the data controller to restrict the processing of the personal data of the data subject if the accuracy of the personal data is contested by the data subject. A data subject has the right to receive the personal data concerning the data subject which the data subject has provided to a data controller in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance.

The right to receive and transfer personal data applies where the processing is based on the data subject's consent or on a contract to which the data subject is a party and is carried out by automated means. A data subject who has suffered material damage as a result of a breach of the data subject's rights under the Act may commence proceedings in the Supreme Court against the data controller or data processor to recover compensation for the damage suffered.

A data controller or data processor is not liable in such proceedings if it proves that it took all reasonable steps and exercised all due diligence to comply with the Act.

The Data Protection Commissioner, a corporation sole, investigates complaints and may serve an enforcement notice requiring a data controller or processor to rectify or erase data or otherwise comply with the Act. A data processor who discloses personal data without the controller's prior authority, and a person who obtains or discloses personal data without authority, each commit an offence.

A person guilty of any offence under the Act is liable on summary conviction to a fine not exceeding two thousand dollars, or on conviction on information to a fine not exceeding one hundred thousand dollars; the Act specifies no term of imprisonment for any offence.

The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions. The Act establishes the Office of the Data Protection Commissioner, which shall be responsible for the regulation and enforcement of data protection and privacy.

Where the Commissioner is satisfied that a data controller has contravened the Act, the Commissioner may serve an enforcement notice requiring the data controller to take or refrain from taking specified steps, or to refrain from processing specified personal data or processing it for a specified purpose or in a specified manner. A person on whom an enforcement notice or an information notice has been served may appeal to the Tribunal against it.

Where an appeal is brought against an enforcement notice, the person upon whom it is served is not required to comply with it pending the determination or withdrawal of the appeal.

The Commissioner may serve a data controller or data processor with an information notice requiring it to provide specified information where the Commissioner reasonably requires any information for the purpose of determining whether the data controller or data processor has complied or is complying with the data protection principles in Part II of the Act. A person commits an offence where the person fails to comply with an enforcement notice, an information notice or a request for assessment.

A person who commits an offence under section 80(1) or (2) is liable upon summary conviction to a fine of fifty thousand dollars or to a term of imprisonment of three years, or to both. A person commits an offence if, in purported compliance with an information notice or request for assessment, the person makes a statement which the person knows to be false in a material respect, or recklessly makes a statement which is false in a material respect.

Where the Commissioner is satisfied that a person has failed or is failing to comply with section 42(2), 43(2), 44, 46, 48, 49, 51, or 53, the Commissioner may issue a penalty notice where he considers it to be in the public interest. A penalty notice issued under section 90(1) has the same force and effect as if the penalty notice was a judgment of the Supreme Court. A person aggrieved by a penalty notice may appeal to the Tribunal within twenty-eight days of the date of the order.

A person shall not knowingly or recklessly, without the consent of the data controller, obtain or disclose personal data or the information contained in personal data, or procure the disclosure to another person of the information contained in personal data. A person who contravenes section 96(1) commits an offence and is liable on summary conviction to a fine not exceeding fifty thousand dollars or to a term of imprisonment not exceeding three years, or to both.

A person who sells, rents or offers to sell personal data commits an offence if the person obtained the personal data in contravention of section 96(1), and is liable on summary conviction to a fine not exceeding one hundred thousand dollars or a term of imprisonment not exceeding five years, or to both.

Where an offence under the Act has been committed by a body corporate with the consent or connivance of, or through neglect on the part of, a director, manager, secretary or other officer of the body corporate, that person and the body corporate are guilty of the offence. Proceedings for an offence under the Act shall not be instituted except by the Director of Public Prosecutions or by the Commissioner with the consent of the Director of Public Prosecutions.

The Act comes into operation on the date the Minister appoints by notice published in the Gazette, and different dates may be appointed in respect of different provisions.

Sensitive personal data means personal data consisting of information on a data subject's racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, trade union membership, genetic data, biometric data for the purpose of uniquely identifying an identifiable natural person, sex life or sexual orientation, medical data, health record, financial record or financial position, criminal record, or proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of the proceedings or the sentence of any court of competent jurisdiction in the proceedings.

Section 35(1) provides that the sensitive personal data of a data subject shall not be processed without the consent in writing of the data subject. Section 35(2)(a) permits processing where the sensitive personal data is necessary for the purposes of exercising or performing a right, or obligation, conferred or imposed by a written law on the data controller, in connection with the employment of the data subject.

Section 35(4) permits processing where it is necessary in order to protect the vital interests of the data subject or another person, in a case where consent cannot be given by or on behalf of the data subject. Sensitive personal data of a data subject may be processed where the information it contains has been made public as a result of steps taken by the data subject.

Sensitive personal data relating to the health of a data subject may only be processed with the consent of the data subject and by or under the responsibility of a health care professional, or by a person subject to the obligation of professional secrecy under a written law. Section 36(2) allows health data to be processed, without those conditions, where the processing is necessary for reasons of public interest in the area of public health.

Section 3 makes it an offence for any person, without authority, knowingly to cause a computer to perform a function for the purpose of securing access to a program or data, whether or not the act was directed at any particular program, data, or computer. Access is unauthorised if the person is not entitled to control access of that kind and lacks consent from someone who is, so authorisation, not the technical means of access, is what the Act tests.

Sections 5 to 8 separately criminalise unauthorised modification of computer material, unauthorised use or interception of a computer service, unauthorised obstruction of a computer's use, and unauthorised disclosure of an access code.

Section 9 imposes enhanced punishment where the computer accessed is a protected computer used for security, defence, confidential law-enforcement sources, banking, financial services, public utilities, public transport, public key infrastructure, or public-safety systems. The Act applies whatever the offender's nationality where either the accused or the computer, program or data was in The Bahamas at the material time.

A compilation, defined as a work formed by collecting and assembling pre-existing materials or data selected, co-ordinated or arranged so that the whole constitutes an original work of authorship, is a protected category of copyright work, and the term compilation includes collective works; the Act creates no separate sui generis database right beyond this originality-based compilation protection.

Copyright in a compilation extends only to the material the compiler contributed, not to the pre-existing material used, and does not enlarge or affect copyright in that pre-existing material. Unauthorised commercial dealing in an infringing copy, including importing it, possessing it in the course of business, or distributing it so as to prejudice the copyright owner, is an offence.

Section 58 permits fair dealing with a copyright work, including reproduction in copies for research, private study, scholarship or teaching, without infringing copyright. Section 59 permits fair dealing with a protected work for the purposes of criticism, comment, parody or review, or for the purpose of reporting current events, so long as the use is accompanied by sufficient acknowledgement; no acknowledgement is required for reporting current events by sound recording or audiovisual work.

Section 60 directs a court determining whether an act is fair dealing to consider all relevant factors, including the nature of the work and the amount and substantiality of the part used relative to the whole.