Law: Data Protection Act 2019 ('the Act')

Regulator: The Act provides for the establishment of a Data Protection Commissioner.

Summary: The Act was published on 26 March 2021, in the Official Gazette, and entered into effect on 31 March 2021 by proclamation from the Governor-General. It provides various rights for individuals and data protection obligations for companies. Among these are the rights of access, rectification, erasure, restriction of processing (as well as in relation to direct marketing), and data portability. The Act is also relatively extensive in its scope of obligations; it establishes, among other things, requirements for breach notification provisions, international data transfers, and data processing registration. Unlike previous legislative attempts, the Act has an extraterritorial scope and applies to the processing of personal data of Barbadians by a controller or processor not established in Barbados when the processing relates to goods or services provided in Barbados.