Barbados. Comprehensive data protection. Act
Barbados DPAData Protection Act, 2019 (Act 2019-29)
Partially in force
Partly verified
Medium confidence.Fine figure from UWI summary; extraterritorial flag from Act's GDPR-like scope (not verified).
§1Summary
- Synopsis
Close transposition of the GDPR with lawful bases, rights, DPOs, 72-hour breach notification and transfer restrictions, overseen by a Data Protection Commissioner with registration of controllers.
- Key themes
- Unique features
Transfer mechanisms including BCRs require Commissioner authorisation.
- SaaS relevance
SaaS providers processing Barbadian data via local customers must support 72h breach notice and transfer safeguards.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Commissioner within 72h where feasible; data subjects if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy + safeguards; BCRs authorised by Commissioner
- Maximum penalty
- Up to BBD 500,000 (serious infractions)
§3Dates
- Key dates
- Adopted
- In force
- Commissioner appointed effective 2021-07-15; some provisions not yet proclaimed
§4Text and authority
- Text
- Authoritative text barbadosparliament.com
- Authority
- Data Protection Commissioner
§5Where it applies
- Domestic law of
- Barbados
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Fine figure from UWI summary; extraterritorial flag from Act's GDPR-like scope (not verified).