Skip to content
World Watch

Data protection & privacy law in Barbados (2026)

Data protection in Barbados: comprehensive law.

Barbados enacted a comprehensive GDPR-style Data Protection Act (Act 2019-29) in August 2019, which was proclaimed in force on 31 March 2021. The Act governs the collection, processing, use, and dissemination of personal data by both public and private controllers and processors, establishes broad data subject rights, and created the Data Protection Commission as the independent supervisory authority.

Last verified Official sources first · MethodologyCompare Barbados with other countries

Legal framework

Data Protection Act, 2019-29, enforced by the Data Protection Commission under the Ministry of Industry, Innovation, Science & Technology

Key points: data & privacy in Barbados

  1. Primary Legislation

    The Data Protection Act, 2019-29 was passed by the Parliament of Barbados in August 2019 and entered force on 31 March 2021. It is modelled closely on the EU GDPR and has strong extraterritorial scope, protecting personal data of Barbadian citizens even when processed abroad.

    barbadosparliament.com bartlettmorgan.com

  2. Supervisory Authority

    The Data Protection Commission, operating under the Ministry of Industry, Innovation, Science & Technology, is the national supervisory authority. Ms. Lisa Greaves was appointed Data Protection Commissioner on 15 July 2021 and is responsible for administration, audits, and enforcement of the Act.

    gov.bb dlapiperdataprotection.com

  3. Controller & Processor Obligations

    Data controllers and processors must register with the Commissioner, appoint a Data Protection Officer (DPO), conduct Data Protection Impact Assessments (DPIAs), notify the Commissioner of breaches within 72 hours (where feasible), and govern processor relationships through written contracts.

    dlapiperdataprotection.com lexcaribbean.com

  4. Data Subject Rights

    Data subjects hold rights of access, rectification, erasure, restriction of processing, data portability (in machine-readable format), and objection, closely mirroring GDPR Chapter III. Withdrawal of consent triggers an erasure right.

    dlapiperdataprotection.com lexmundi.com

  5. Penalties & Enforcement

    Contraventions carry fines from BBD 10,000 up to BBD 500,000 (approx. USD 240,000) and/or up to three years' imprisonment. A dedicated Data Protection Tribunal hears appeals from Commissioner decisions.

    caseguard.com dlapiperdataprotection.com

  6. Phased Commencement

    Not all provisions of the Act entered force on 31 March 2021; as of 2022 certain obligations including full controller registration requirements were still being phased in, with no publicly announced fixed compliance deadline. Some provisions remain to be separately proclaimed.

    barbadostoday.bb bartlettmorgan.com

Sources

  1. barbadosparliament.com/bills/details/396
  2. bartlettmorgan.com/2021/03/27/barbados-advanced-privacy-law-now-enforceable/
  3. gov.bb/Departments/data-protection-commissioner
  4. dlapiperdataprotection.com/index.html?t=authority&c=BB
  5. dlapiperdataprotection.com/index.html?t=law&c=BB
  6. lexcaribbean.com/barbados-a-modern-data-protection-regime/
  7. lexmundi.com/guides/data-privacy-guide/jurisdictions/caribbean/barbados/
  8. caseguard.com/articles/the-act-safeguarding-the-privacy-of-barbadian-citizens/
  9. barbadostoday.bb/2022/05/19/get-familiar-with-data-protection-laws/

Next for Barbados: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026