Law: Data Protection Act 2019 (the Act)

Regulator: The Act provides for the establishment of a Data Protection Commissioner.

Summary: The Data Protection Act 2019 (the Act) entered into effect on March 31, 2021 by proclamation from the Governor-General and is modeled on the EU's GDPR. It provides various rights for individuals and data protection obligations for companies. Among these are the rights of access, rectification, erasure, restriction of processing (as well as in relation to direct marketing), and data portability. The Act is also relatively extensive in its scope of obligations; it establishes requirements for breach notification provisions, international data transfers, and data protection impact assessments. Unlike previous legislative attempts, the Act has an extraterritorial scope and applies to the processing of personal data of Barbadians by a controller or processor not established in Barbados when the processing relates to goods or services provided to data subjects in Barbados.