Data protection & privacy laws in Barbados (2026)

The Data Protection Act, 2019-29 was passed by the Parliament of Barbados in August 2019 and entered force on 31 March 2021. It is modelled closely on the EU GDPR and has strong extraterritorial scope, protecting personal data of Barbadian citizens even when processed abroad.

The Data Protection Commission, operating under the Ministry of Industry, Innovation, Science & Technology, is the national supervisory authority. Ms. Lisa Greaves was appointed Data Protection Commissioner on 15 July 2021 and is responsible for administration, audits, and enforcement of the Act.

Data controllers and processors must register with the Commissioner, appoint a Data Protection Officer (DPO), conduct Data Protection Impact Assessments (DPIAs), notify the Commissioner of breaches within 72 hours (where feasible), and govern processor relationships through written contracts.

Data subjects hold rights of access, rectification, erasure, restriction of processing, data portability (in machine-readable format), and objection — closely mirroring GDPR Chapter III. Withdrawal of consent triggers an erasure right.

Contraventions carry fines from BBD 10,000 up to BBD 500,000 (approx. USD 240,000) and/or up to three years' imprisonment. A dedicated Data Protection Tribunal hears appeals from Commissioner decisions.

Not all provisions of the Act entered force on 31 March 2021; as of 2022 certain obligations including full controller registration requirements were still being phased in, with no publicly announced fixed compliance deadline. Some provisions remain to be separately proclaimed.