Sign in

Bahamas DPA

Data Protection (Privacy of Personal Information) Act, 2003 (The Bahamas) — Office of the Data Protection Commissioner (The Bahamas)

Also known as: Bahamas DPA, Data Protection (Privacy of Personal Information) Act, Bahamas Data Protection Act

Official site Official change log Subscribe to Bahamas DPA (RSS)

Current version
Data Protection (Privacy of Personal Information) Act, Ch. 324A
Published 11 April 2003. source
Status
In force
Next deadline
None announced
Who must comply
Data controllers established in The Bahamas, and those established elsewhere that use equipment in The Bahamas to process data other than in transit. source
How it is assessed
The Commissioner investigates on a complaint or on his own opinion, may require information and may approve codes of practice. source
Authority
An Act of the Parliament of The Bahamas, enforced by the Data Protection Commissioner, who investigates complaints and issues enforcement and prohibition notices. source
Enforced by
Enforcement and prohibition notices from the Commissioner, with criminal fines of up to $100,000 on conviction on information. source
Last change
None recorded yet

The Bahamian data protection statute, short by modern standards and closer to the pre-GDPR European model: fair-processing rules, a right of access and correction, and a Data Protection Commissioner who investigates complaints and issues enforcement notices. It reaches financial and professional services firms serving Bahamian clients, which is where most questions about it come from.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. Data Protection Act, 2025 (No. 74 of 2025), which repeals Chapter 324A, published in the Official Gazette; enacted, not yet in force
  2. Data Protection Act, 2025 receives assent
  3. The Data Protection (Privacy of Personal Information) Act comes into force
  4. The Data Protection (Privacy of Personal Information) Act receives assent

Amendments

  1. Data Protection (Privacy of Personal Information) Act, Ch. 324A Major versionCurrent text

    Act No. 3 of 2003, assented on 11 April 2003 and brought into force on 2 April 2007 by S.I. 25/2007. source

Who it applies to

Data controllers established in The Bahamas, or established elsewhere and using equipment there, with exclusions such as national security and household data.

Established in The Bahamas
Residents, bodies incorporated or registered and partnerships formed under Bahamian law, and anyone keeping an office, branch or agency there (section 4). source
Foreign controllers
A controller not established in The Bahamas but using equipment there must nominate a representative established in The Bahamas. source
Exclusions
National security data, information required by law to be public, personal or household data, parliamentary deliberations and pending legal proceedings (section 5). source
Individuals' rights
Rights of access, of rectification or erasure, and to prohibit processing for direct marketing (sections 8 to 11). source

How compliance is assessed

The Commissioner investigates on a complaint or on his own opinion, may require information and may approve codes of practice.

Investigations
The Commissioner may investigate whether the Act is being contravened, on a complaint or on his own opinion, and must investigate complaints unless frivolous or vexatious (section 15). source
Information notices
The Commissioner may require a person to furnish information (section 18). source
Codes of practice
The Commissioner may encourage trade associations and similar bodies to prepare codes of practice and may approve them (section 20). source

Enforcement and penalties

Enforcement and prohibition notices from the Commissioner, with criminal fines of up to $100,000 on conviction on information.

Up to $100,000

Section 29(1)(b), on conviction on information for an offence under the Act. source

Up to $2,000

Section 29(1)(a), on summary conviction; the court may also order data material forfeited or destroyed and data erased. source

Enforcement notices
Where a controller or processor contravenes a provision that is not itself an offence, the Commissioner may serve an enforcement notice requiring steps to comply (section 15). source
Transfers abroad
The Commissioner may prohibit a transfer of personal data out of The Bahamas where protection equivalent to the Act is not provided (section 17). source
Appeals
Notices and complaint decisions can be appealed to the Supreme Court within twenty-one days (section 24). source

Documents

  1. Law text Data Protection (Privacy of Personal Information) Act, Ch. 324A
  2. Law text Data Protection Act, 2025 (No. 74 of 2025) — enacted, not yet in force
  3. Guidance Laws of The Bahamas — acts of 2025
  4. Guidance Office of the Data Protection Commissioner

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 21 September 2026. Subscribe to Bahamas DPA (RSS)