Belize

The Practice Direction, made by the Rules Committee on 11 August 2025 and effective from 12 August 2025, applies to all legal professionals, judges, court personnel, attorneys, parties, witnesses, self-represented persons, and other court users, not only judicial officers.

It prohibits using generative AI to generate the content of an affidavit, witness statement, or other material meant to reflect a deponent's or witness's own evidence, and requires disclosure when AI-generated content is used in court submissions, including legal arguments, precedents, and reports, together with independent verification of any AI-generated legal research before it is relied on.

A court user who relies on AI output assumes full responsibility for its accuracy, relevance, and appropriateness, and non-compliance can result in rejection of AI-generated submissions, ethical review, or other disciplinary measures. The Direction governs the use of AI tools within litigation and does not impose a duty on an AI product or service provider outside that context.

Section 61 requires a data controller, where feasible, to notify the Commissioner of a personal data breach not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to a person's rights and freedoms, with reasons required for any later notification; a data processor must notify the controller without undue delay.

Section 62 requires the controller to notify an affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an exempting condition, such as prior encryption of the data, applies. No notice appointing the day the Act comes into force has been located.

The Act applies to the processing of personal data by a data controller or processor established in Belize, and to the processing of personal data of data subjects in Belize by a controller or processor established elsewhere where the processing relates to offering goods or services to those data subjects, subject to an exemption for a small business (annual turnover of $3,000,000 or less) that does not extend to a business trading in personal information, providing a health service, or several other listed activities.

Section 4 sets the standard lawfulness, purpose-limitation, and data-minimisation principles, and section 7 requires a lawful basis such as consent, a contract with the data subject, or a legal obligation before processing.

Section 10 prohibits processing sensitive personal data, which includes racial or ethnic origin, religious belief, genetic data, biometric data, and sexual orientation, unless one of a listed set of conditions applies, among them the data subject's consent or a deliberate act by the data subject making the information public; section 9 sets the age of digital consent for a child's own consent at thirteen.

Sections 11 to 18 give a data subject rights of access, rectification, erasure, restriction, and data portability, and a right to prevent processing likely to cause damage or distress or intended for direct marketing.

Section 19 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect, subject to exceptions for a contract, an authorising enactment with safeguards, or the data subject's consent. Section 19(4) withholds those exceptions from sensitive personal data unless the processing is in the public interest with suitable safeguards in place. No notice appointing the day the Act comes into force has been located.

Part IV requires a transferor sending personal data outside Belize to ensure either an adequate level of protection, assessed against factors including the destination country's law and international obligations, or an appropriate safeguard, such as a legally binding instrument between public authorities, binding corporate rules, or standard or authorised contractual clauses.

Section 23(2) expressly disapplies both requirements, and the need for the data subject's consent, to a transfer made for the purposes of cloud storage. No notice appointing the day the Act comes into force has been located.

The Act creates a Data Protection Commissioner, a public officer in the ministry responsible for digital transformation who monitors and enforces the Act and must act independently, and a Data Protection Tribunal to hear appeals from an Enforcement, Information, or Special Information Notice the Commissioner issues, with a further appeal on a point of law to the Supreme Court.

Section 91 entitles an individual who suffers damage or distress from a controller's or processor's contravention of the Act to compensation, subject to a defence that the defendant took all reasonably required measures to comply.

Separately, section 92 makes it an offence for a person to knowingly or recklessly obtain, disclose, or procure the disclosure of personal data without the controller's consent, punishable by a fine of ten thousand dollars, subject to defences including that the obtaining was necessary to prevent or detect crime or was in the public interest. No notice appointing the day the Act comes into force has been located.

Section 3 makes it an offence to intentionally access a computer system of another person either without authorisation or in excess of authorisation, or by infringing a security measure of the system, and section 3(2) separately makes it an offence to continue to exceed authorised access without lawful excuse.

Because the first limb of the offence is disjunctive with the security-measure limb, a plain reading reaches a person who accesses a system without permission even where no security measure was defeated, which is broader than a statute that requires infringing a security measure in every case, though no reported Belizean case has applied section 3 to the scraping of a public, unauthenticated page specifically.

The offence carries a fine of three thousand dollars and imprisonment of up to three years on summary conviction, rising to a fine of five thousand dollars and imprisonment of up to five years on conviction on indictment.

Section 56 permits fair dealing with a protected work for the purpose of research or private study. Section 57(2) separately permits fair dealing with a protected work, other than a photograph, for reporting current events, subject to a sufficient acknowledgement except where the reporting is by sound recording, film, broadcast, or cable programme.

Section 58 sets a four-factor fair-dealing test: the nature of the work, the extent and substantiality of the part used, the effect on the potential market for or commercial value of the work, and the purpose and character of the use. The Act contains no text-and-data-mining exception and no sui generis database right, so training a model on scraped copyrighted Belizean text rests only on whether the research or private-study ground, tested against the section 58 factors, can be made out.

Civil remedies, including injunction and delivery up, are the mechanism for infringement by reproduction; separate criminal offences under section 52 attach to commercial dealing in infringing physical articles rather than to digital reproduction.

The Data Protection Act, 2021 defines personal data without excluding information that is otherwise publicly accessible, and applies to a data controller or processor established in Belize or offering goods or services to data subjects there, so scraping personal data from a public Belizean website would remain subject to the Act's lawful-basis, purpose-limitation, and cross-border-transfer duties once the Act is in force.

A narrower condition lets sensitive personal data, which includes biometric data, be processed where the data subject has deliberately made the information public, but this does not extend to ordinary personal data generally. No notice appointing the day the Act comes into force has been located.

Regulation 18(2)(c) of the National Payment System Regulations, 2024 lets the Central Bank require a payment service provider to obtain and submit, for any specified period, a system security audit report by a reputable independent auditor on its payment service. Regulation 18(3) of the National Payment System Regulations, 2024 applies the requirements of regulation 18(1)(a), (b) and (c) and regulation 18(2) to an operator.

Regulation 17(1) of the National Payment System Regulations, 2024 lets the Central Bank issue a directive to an operator, participant, payment service provider or other person on any matter affecting the security, integrity and stability of the National Payment System. Under regulation 17(3) of the National Payment System Regulations, 2024 a directive is binding on the person to whom it is directed.

The National Payment System Regulations, 2024 were made by the Central Bank of Belize on 5 February 2024. Section 33 of the National Payment System Act lets the Central Bank take administrative measures, including a fine not exceeding two thousand dollars for each day that an infringement continues, against a person who commits an infringement.

Section 33(4) of the National Payment System Act makes it an offence to fail to comply with an order issued, a fine imposed or other administrative measures taken by the Central Bank under that section. Section 56(1) of the National Payment System Act empowers the Central Bank to issue regulations, orders, directives, guidelines or notices for carrying into effect the provisions of the Act. No commencement notice for the provisions this entry describes has been located.

Regulation 18(1)(c) of the National Payment System Regulations, 2024 requires a payment service provider to submit to the Central Bank, in the manner and at the times the Central Bank requires, information on service interruptions and security breaches. Regulation 18(3) of the National Payment System Regulations, 2024 applies the requirements of regulation 18(1)(a), (b) and (c) and regulation 18(2) to an operator.

Regulation 19(4) of the National Payment System Regulations, 2024 requires a payment service provider to notify the Central Bank in writing as soon as practicable after any disruption or restriction in the provision of the service to consumers and after any attempted or actual fraud committed through the payment service.

Regulation 19(3)(c) of the National Payment System Regulations, 2024 requires an operator to notify the Central Bank in writing as soon as practicable after any failure of the operation of the system, including a disruption in availability, fraudulent use of the system and failure of settlement.

Regulation 19(5) of the National Payment System Regulations, 2024 requires each notice to include a report on the circumstances of the event, the remedial action taken at or after the event and the intended preventative or remedial action. The National Payment System Regulations, 2024 were made by the Central Bank of Belize on 5 February 2024.

Section 33 of the National Payment System Act lets the Central Bank take administrative measures, including a fine not exceeding two thousand dollars for each day that an infringement continues, against a person who commits an infringement. Section 33(4) of the National Payment System Act makes it an offence to fail to comply with an order issued, a fine imposed or other administrative measures taken by the Central Bank under that section.

Section 56(1) of the National Payment System Act empowers the Central Bank to issue regulations, orders, directives, guidelines or notices for carrying into effect the provisions of the Act. No commencement notice for the provisions this entry describes has been located.

Section 57(2) permits fair dealing with a protected work, other than a photograph, for the purpose of reporting current events, without infringing copyright, so long as the reporting is accompanied by a sufficient acknowledgement of the work's title and author. Section 57(3) dispenses with the acknowledgement requirement where the reporting of current events is by sound recording, film, broadcast, or cable programme.

The exception is subject to the section 58 four-factor fair-dealing test, which weighs the nature of the work, the extent of the part used, the effect on the work's potential market, and the purpose and character of the use, so it carries no fixed headline-length or short-extract cap of its own.