Data protection & privacy law in Bahamas (2026)

Legal framework

Data Protection Act, 2025 (assented 9 December 2025; replaces the Data Protection (Privacy of Personal Information) Act, 2003). Supervisory authority: Office of the Data Protection Commissioner.

Key points: data & privacy in Bahamas

1. 01Legislative history

   The Data Protection (Privacy of Personal Information) Act 2003 (in force 2007) was among the first comprehensive data protection laws in the Caribbean, grounded in the 1980 OECD Privacy Guidelines. The 2025 Act repeals and replaces it to reflect contemporary international standards.

   laws.bahamas.gov.bs laws.bahamas.gov.bs

2. 02Supervisory authority

   The Office of the Data Protection Commissioner (dataprotection.gov.bs) serves as the independent supervisory authority. It investigates complaints, issues enforcement and prohibition notices, conducts assessments, and acts as a privacy Ombudsman for the public and private sectors.

   dataprotection.gov.bs bahamas.gov.bs

3. 03Individual rights

   Data subjects hold rights to access, correction, and deletion of personal data, to object to direct marketing, and to be notified of disclosures. The 2025 Act significantly expands these rights to give individuals greater control aligned with GDPR-era standards.

   laws.bahamas.gov.bs dataprotection.gov.bs

4. 04Controller obligations

   Data controllers must register with the Commissioner, adhere to eight data protection principles (lawful collection, purpose limitation, data minimisation, accuracy, retention limits, security, individual rights, and transfer restrictions), implement security measures, and notify the Commissioner and affected individuals in the event of a data breach. Fines reach up to BSD $100,000.

   laws.bahamas.gov.bs cdn.bahamas.gov.bs

5. 05International data transfers

   The 2025 Act introduces explicit provisions on cross-border transfers of personal data, prohibiting transfer to jurisdictions without adequate protection, a rule already present in the 2003 Act but now substantially strengthened.

   laws.bahamas.gov.bs biometricupdate.com

6. 06Emerging technology scope

   The 2025 Act expressly addresses biometrics, artificial intelligence, fintech, digital assets, e-commerce, and cloud computing, areas not covered by the 2003 Act, reflecting the government's digital transformation strategy.

   opm.gov.bs biometricupdate.com

Timeline of decisions

1. 1 Dec 2025Law · official
   Data Protection Act, 2025 Gazetted as Enacted Law

   The Data Protection Act, 2025 was published in the Official Gazette of The Bahamas as principal legislation, replacing the 2003 Act with a GDPR-aligned framework that mandates breach notification, expands personal data definitions to include biometric and genetic data, codifies data-subject rights (access, correction, erasure), and requires registration of all data controllers and processors.

   Official Gazette of The Bahamas (laws.bahamas.gov.bs)

2. 1 Nov 2025Law
   House of Assembly MPs Scrutinise Biometric and Genetic Data Provisions in Data Protection Bill

   Members of Parliament examined novel provisions covering biometric and genetic data, the right to erasure, and mandatory breach-notification windows, marking the first substantive legislative update to the Bahamas privacy framework in over two decades and drawing regional attention to the bill's GDPR-inspired architecture.

   Biometric Update

3. 21 Aug 2025Guidance · official
   Office of Data Protection Commissioner Releases Draft Data Protection Bill 2025 for Public Consultation

   The Data Protection Commissioner launched a formal 30-day public consultation on the draft Data Protection Bill 2025, the first comprehensive reform proposal since 2003, drawing on GDPR principles and the findings of an ECLAC review that identified significant deficiencies in the existing law.

   Office of the Data Protection Commissioner, The Bahamas (dataprotection.gov.bs)

4. 21 Aug 2025Law · official
   Data Protection Bill 2025 Tabled, GDPR-Aligned Overhaul of 2003 Act

   The Bahamas laid the Data Protection Bill 2025 before Parliament to repeal and replace the 2003 Act with a GDPR-inspired framework covering breach notification, cross-border data-transfer controls, a strengthened Data Protection Commissioner's office, and provisions for AI, biometrics, and cloud computing. The lower chamber passed the draft; phased commencement by ministerial notice is anticipated.

   Bahamas Laws (Official Gazette)

5. 4 Oct 2023Guidance
   Governor General's Speech from the Throne Commits Davis Government to New Data Protection Legislation

   Governor General Cynthia Pratt's address opening the parliamentary session included a formal commitment to enact modernised data protection legislation, the first official signal that the 2003 Act would be comprehensively replaced rather than merely amended.

   Nassau Guardian

6. 1 Jan 2020Decision · official
   ECLAC Review Identifies Significant Gaps in Bahamas Data Protection Relative to GDPR

   The UN Economic Commission for Latin America and the Caribbean reviewed The Bahamas' data protection framework and found material deficiencies, no breach-notification obligation, limited data-subject rights, weak enforcement tools, compared to GDPR and contemporary international standards, providing the analytical foundation for the 2025 reform.

   Bahamas Official Gazette — Data Protection Bill 2025 Consultation Document (citing ECLAC review)

7. 2 Apr 2007Law
   Data Protection Act 2003 Enters into Force; First Data Protection Commissioner Appointed

   Commencement Order S.I. 25/2007 brought the Data Protection (Privacy of Personal Information) Act 2003 into legal effect and the Office of the Data Protection Commissioner was activated, making The Bahamas one of the first Caribbean states with a functioning, independent data-protection supervisory authority.

   Bahamas Financial Services Board (bfsb-bahamas.com)

8. 11 Apr 2003Law · official
   Data Protection (Privacy of Personal Information) Act 2003 Receives Royal Assent

   The Bahamas enacted its foundational data-protection statute, modelled on the 1980 OECD Privacy Guidelines and applicable to both public and private sector data processing, making The Bahamas a regional pioneer and the first Caribbean nation to pass a comprehensive personal-data protection law.

   Statute Law of The Bahamas (laws.bahamas.gov.bs)

Sources

1. 1.laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0074/2025-0074.pdf
2. 2.laws.bahamas.gov.bs/cms/images/LEGISLATION/BILLS/2025/2025-0079/2025-0079.pdf
3. 3.laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2003/2003-0003/2003-0003.pdf
4. 4.dataprotection.gov.bs/about-the-office-of-the-data-protection-commissioner
5. 5.dataprotection.gov.bs/news-press-release/public-consultation-on-the-draft-data-protection-b
6. 6.opm.gov.bs/prime-minister-davis-contribution-to-the-data-protection-bill-2025/
7. 7.biometricupdate.com/202511/bahamas-mps-examine-new-data-protection-bill-with-novelties
8. 8.bahamas.gov.bs/office-of-the-data-protection-commissioner
9. 9.cdn.bahamas.gov.bs/tenant/tenantdataprotection/documents/All%20Documents/Data20guide-202