Skip to content
World Watch

Cybersecurity law & regulation in Bahamas (2026)

Cybersecurity in Bahamas: sectoral rules.

The Bahamas relies on a fragmented set of domain-specific laws, principally the Computer Misuse Act 2003 and Data Protection Act 2003, rather than a single comprehensive cybersecurity statute. There is currently no mandatory breach-notification or incident-reporting duty, though a Data Protection Bill 2025 under parliamentary consideration would introduce GDPR-inspired requirements including mandatory breach notification. A Cabinet-approved National Cybersecurity Strategy was launched in December 2024, establishing a policy road-map but not yet backed by new primary legislation.

Last verified Official sources first · MethodologyCompare Bahamas with other countries

Legal framework

Computer Misuse Act 2003 (cybercrime); Data Protection Act 2003 (data security); Electronic Communications and Transactions Act 2003 (digital transactions); National Cybersecurity Strategy launched December 2024 (policy); Data Protection Bill 2025 (proposed)

Key points: cybersecurity in Bahamas

  1. Computer Misuse Act 2003

    The sole Bahamian law addressing cybercrime directly, criminalising unauthorised access, modification, and interception of computer systems, as well as disclosure of access codes. It carries extraterritorial jurisdiction when either the accused or the affected computer was in The Bahamas at the time of the offence.

    dig.watch higgsjohnson.com

  2. Data Protection Act 2003, security duties, no mandatory notification

    Data controllers must implement appropriate technical and organisational security measures, but there is currently no statutory obligation to notify the Data Protection Commissioner or affected individuals of a data breach. The Commissioner has issued voluntary guidance on managing security breaches.

    dlapiperdataprotection.com cdn.bahamas.gov.bs

  3. Data Protection Bill 2025, proposed overhaul

    A draft bill tabled in Parliament in 2025 would repeal and replace the 2003 DPA with a GDPR-inspired regime covering biometrics, AI, cloud computing, and digital assets. It explicitly introduces a 'Notification of breach of personal data' obligation and establishes a statutory Office of the Data Protection Commissioner.

    laws.bahamas.gov.bs bahamas.gov.bs

  4. National Cybersecurity Strategy, December 2024

    The Cabinet-approved National Cybersecurity Strategy, launched at a December 2024 workshop, sets out five pillars: cybersecurity governance, national incident prevention and response, critical information infrastructure protection, cybersecurity awareness and skills, and international cooperation. It is a policy instrument, not a binding legal framework.

    bahamas.gov.bs magneticmediatv.com

  5. Electronic Communications and Transactions Act 2003

    Governs electronic signatures, data retention for communications, intermediary liability, and electronic evidence. It complements but does not substitute for dedicated cybersecurity legislation; ISPs and hosts receive limited safe-harbour protections.

    ectabahamas.com asianlaws.org

  6. No Budapest Convention ratification; international engagement ongoing

    The Bahamas is listed in the Council of Europe Octopus Cybercrime Community as an observer but has not ratified the Budapest Convention on Cybercrime. It has engaged with the OAS, ITU, and US Embassy for technical assistance in developing its cybersecurity strategy and a national CERT.

    coe.int oas.org

Timeline of decisions

  1. Guidance
    National Cybersecurity Strategy Formally Launched at Nassau Workshop

    The Cabinet-approved National Cybersecurity Strategy was publicly launched at a multi-day workshop (3-6 December, Nassau) co-supported by the U.S. Embassy, CISA, and MITRE, setting five strategic pillars to guide Bahamian cyber resilience. CIRT-BS was designated as the primary implementation authority.

    Magnetic Media TV

  2. Decision · official
    CIRT-BS Becomes Operational and Joins FIRST

    The National Computer Incident Response Team commenced full public services, incident management, vulnerability assessments, and awareness training, and The Bahamas became the first English-speaking Caribbean nation admitted to the global Forum of Incident Response and Security Teams (FIRST), cementing its regional coordination role.

    Caribbean Development Portal (UN ECLAC)

  3. Decision · official
    CIRT-BS Formally Established as National Incident Response Authority

    The Government officially launched the National Computer Incident Response Team (CIRT-BS) on 14 December 2023, creating the country's first national cyber-incident response body under the Office of the Prime Minister, responsible for real-time monitoring and coordinated public/private-sector response to cyberattacks.

    Cybil Portal (ITU/GFCE)

  4. Guidance · official
    Central Bank Issues Technology Risk Management Guidelines for Licensees

    The Central Bank of The Bahamas published sector-wide Technology Risk Management Guidelines mandating board-level IT-risk oversight, cybersecurity controls (strong card authentication, encryption, patch management), business-continuity planning, and customer-data protection for all regulated financial institutions, the principal cybersecurity compliance instrument for the Bahamian financial sector.

    Central Bank of The Bahamas

  5. Decision
    Royal Bahamas Police Force Establishes Dedicated Cyber Security Unit

    The Ministry of National Security merged the Tracing & Forfeiture Section and Commercial Crime Section into a new RBPF Cyber Security Unit staffed by trained cyber investigators and forensic specialists (partly trained by U.S. federal law enforcement agencies), giving The Bahamas its first dedicated law-enforcement capability for cybercrime investigation.

    Magnetic Media TV

  6. Law · official
    Computer Misuse Act Enacted, Foundational Cybercrime Statute

    The Computer Misuse Act, enacted April 2003 and brought into force June 2003, became the Bahamas' principal cybercrime law, criminalising unauthorised computer access, interception, modification, and disclosure of access codes; it applies extraterritorially and remains the primary statute under which cybercrime offences are charged.

    Council of Europe Octopus Cybercrime Community

Sources

  1. dig.watch/resource/the-computer-misuse-act-of-the-bahamas
  2. higgsjohnson.com/cybercrime-under-bahamian-law/
  3. dlapiperdataprotection.com/index.html?t=breach-notification&c=BS
  4. cdn.bahamas.gov.bs/tenant/tenantdataprotection/documents/All%20Documents/Managing20Data2
  5. laws.bahamas.gov.bs/cms/images/LEGISLATION/BILLS/2025/2025-0079/2025-0079.pdf
  6. bahamas.gov.bs/news-press-release/public-consultation-on-the-draft-data-protection-b
  7. bahamas.gov.bs/wps/portal/public/gov/government/news/prime%20ministers%20national%20
  8. magneticmediatv.com/2024/12/the-bahamas-strengthens-cybersecurity-with-national-cybersecu
  9. ectabahamas.com/
  10. coe.int/en/web/octopus/-/bahamas
  11. oas.org/en/media_center/press_release.asp?sCodigo=E-173/14
  12. asianlaws.org/gcld/cyberlawdb/BS/Electronic%20Communications%20and%20Transactions%2

Next for Bahamas: Starting a BusinessModerate

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026