Barbados: technology regulation at a glance

Framework: No dedicated digital-assets statute in force; sector governed under general financial-services and AML/CFT laws supervised by the Central Bank of Barbados (CBB) and the Financial Services Commission (FSC); VASP-specific legislation under active public consultation (FSC deadline: 23 February 2026)

Crypto assets are legal in Barbados but no bespoke virtual-assets law has been enacted. The CBB and FSC jointly operate a Regulatory Sandbox and the FSC opened a formal public consultation in late 2025/early 2026 to develop a comprehensive VASP/digital-assets framework. Barbados signed the OECD CARF Multilateral Competent Authority Agreement on 26 November 2024, committing to automatic exchange of crypto-asset tax data by 2028.

Framework: Data Protection Act 2019-29 (GDPR-modelled, fully in force); Central Bank of Barbados AI policy analyses; GovTech Barbados public-sector AI initiatives; announced but unenacted legislative overhaul covering AI, telecommunications, and electronic transactions

Barbados has no enacted or formally tabled AI-specific legislation. The primary applicable framework is the GDPR-modelled Data Protection Act 2019-29, which governs automated personal-data processing. The Central Bank of Barbados has published analytical AI policy guidance and the government has publicly committed to a future legislative overhaul that would include an AI governance framework, but as of May 2026 no AI bill has been introduced in Parliament.

Framework: Data Protection Act, 2019-29, enforced by the Data Protection Commission under the Ministry of Industry, Innovation, Science & Technology

Barbados enacted a comprehensive GDPR-style Data Protection Act (Act 2019-29) in August 2019, which was proclaimed in force on 31 March 2021. The Act governs the collection, processing, use, and dissemination of personal data by both public and private controllers and processors, establishes broad data subject rights, and created the Data Protection Commission as the independent supervisory authority.

Framework: National Payment System Act (NPSA), 2021, administered by the Central Bank of Barbados (CBB); supported by the National Payment System (Payment Services and Electronic Money) Regulations, S.I. 2026 No. 46, and the CBB's 2025 Framework for Licensing & Authorising Payment Service Providers. Fintech innovation is also handled via the joint CBB/FSC Regulatory Sandbox.

Barbados has an in-force licensing regime for digital payments. The National Payment System Act 2021 makes the Central Bank of Barbados the oversight authority and requires any entity providing a payment service to be licensed (NPSA s.9), with e-money instruments and payment service providers explicitly within scope; subsidiary regulations covering payment services and electronic money were issued in 2026. In September 2025 the CBB published its formal Oversight, Licensing/Authorisation and Supervisory frameworks, and the national instant-payment rail BiMPay is scheduled to go live on 12 June 2026.

Framework: Barbados Welcome Stamp Programme, administered by the Ministry of Foreign Affairs and Foreign Trade; complemented by the Special Entry and Residence Permit (SERP) under the Immigration Act (Cap. 190)

Barbados operates a dedicated 12-month remote-work visa called the Welcome Stamp, launched July 2020 and extended by Cabinet through December 31, 2026. It permits non-Barbadian remote workers earning at least USD 50,000/year to live and work remotely in Barbados for a non-renewable (but re-applicable) one-year period. A separate residency-by-investment route (SERP) provides longer-term or permanent residency for qualifying investors.

Framework: Computer Misuse Act 2005; Data Protection Act 2019 (fully in force January 2025); Cybercrime Bill 2024 (passed House of Assembly, pending Senate)

Barbados regulates online conduct through the legacy Computer Misuse Act 2005 and the GDPR-modelled Data Protection Act 2019. A sweeping Cybercrime Bill passed the House of Assembly in February 2024 but remained before a parliamentary Joint Select Committee as of early 2025, having not yet received Senate assent. There is no dedicated online-safety or platform-liability law equivalent to the EU DSA or UK OSA, and no state-imposed internet censorship or content blocking.

Framework: Computer Misuse Act 2005 (primary cybercrime statute); Data Protection Act 2019 No. 29 (breach notification); Cybercrime Bill 2024 (pending Senate enactment to replace CMA); National CIRT established via ITU agreement

Barbados operates a sectoral cybersecurity regime anchored by the Computer Misuse Act 2005, which criminalises unauthorised computer access and related offences, supplemented by the Data Protection Act 2019 which imposes 72-hour breach-notification duties on data controllers. A comprehensive Cybercrime Bill 2024, drafted to replace the CMA and align with the Budapest Convention, passed the House of Assembly in February 2024 but was referred to a Joint Select Committee amid free-expression concerns; as of early 2025 the Senate was preparing to vote on the committee's report, with final enactment unconfirmed as of May 2026. No NIS2-style law imposing risk-management or incident-reporting obligations on critical-infrastructure operators exists.

Framework: Companies Act (Cap. 308) administered by the Corporate Affairs and Intellectual Property Office (CAIPO); foreign investment overseen by Invest Barbados, with the Exchange Control Act (Cap. 71) administered by the Central Bank of Barbados and the Foreign Currency Permits Act 2025-5.

Barbados permits 100% foreign ownership of companies with no local director, shareholder, or minimum-capital requirement, and incorporation through CAIPO is relatively quick. However, the process involves multiple steps and intermediaries, a locally licensed corporate secretary, a registered office via a licensed service provider, multi-agency registration, and Central Bank exchange-control permission for non-residents to hold shares in a domestic company (or a Foreign Currency Permit exemption), making it straightforward but not frictionless.