What Is Data Protection Act, 2019–29 (Act 2019-29)?
The governing statute is the Data Protection Act, 2019–29, assented to on 12 August 2019. The official proclamation located brought the Act into operation on 31 March 2021 but expressly excluded sections 50, 51, 52, 55, 56 and 57, concerning controller and processor registration, registers, change notifications, and related processor provisions. No later proclamation bringing those sections into force, or later materially amending Act 2019-29, was located in the official materials searched through 9 October 2026. This is a documented search result, not confirmation that no later instrument exists. The official Data Protection Commission page confirms that the Commission administers the framework, registers controllers and processors, promotes awareness, and investigates complaints concerning data breaches. The Act provides a broad rights framework, including access, rectification, erasure, restriction, portability, direct-marketing objection, protection against specified solely automated decisions, consent withdrawal, complaints, and compensation for damage or distress. A significant limit is the public-record exemption: personal data that a controller is obliged by or under an enactment to make public is exempt from Parts II, III, IV and VI.
At a glance
- Full name
- Data Protection Act, 2019–29 (Act 2019-29)
- Short code
- Data Protection Act 2019-29
- Jurisdiction
- Barbados
- Enacted
- 2019
- Last major update
- Came into operation on 31 March 2021, excluding sections 50, 51, 52, 55, 56 and 57; no later commencement instrument or materially amending Act/order was located, but that is not proof that no later instrument exists
- Regulator
- Data Protection Commissioner and Data Protection Commission
- Private right of action
- Yes
- Statutory citation
- Data Protection Act, 2019–29 (Act 2019-29)
Scope, who Data Protection Act 2019-29 covers
Protected data
Data subject rights
Right to access and transparency, including processing purposes, data categories, recipients including overseas recipients, retention period or criteria, available rights, complaint rights, source information, automated-decision logic and consequences, and international-transfer safeguards
Right to rectification of inaccurate data and completion of incomplete data without undue delay
Right to erasure without undue delay where data is no longer necessary, consent is withdrawn without another lawful basis, a valid objection succeeds, processing is unlawful, or deletion is legally required
Right to restriction where accuracy is disputed, processing is unlawful but erasure is opposed, data is needed for legal claims, or an objection is under review
Right to portability of data supplied by the subject in a structured, commonly used, machine-readable format where statutory conditions apply
Right to object to direct marketing, requiring cessation within 21 days
Right not to be subject solely to automated processing, including profiling, producing legal or similarly significant effects, subject to statutory exceptions
Right to withdraw consent without affecting prior lawful processing
Right to complain to the Commissioner and seek compensation for proven damage or distress
Notable features
Barbados has a broad rights framework but incomplete commencement remains material: sections 50, 51, 52, 55, 56 and 57 were excluded from the 31 March 2021 proclamation, and no later commencement instrument was located. The public-record exemption is also significant because data required by enactment to be public is exempt from Parts II, III, IV and VI.
Enforcement & penalties
Regulator: Data Protection Commissioner and Data Protection Commission
Penalties: Core data-protection and security obligations, unlawful international transfers, processing outside controller instructions, and false material statements in response to an information notice may carry up to BDS $500,000, 3 years’ imprisonment, or both. Failure to comply with enforcement, information, or special information notices may carry up to BDS $15,000 or 6 months. Unlawfully obtaining, disclosing, or procuring personal data may carry up to BDS $10,000 or 6 months; selling or offering unlawfully obtained personal data may carry up to BDS $100,000, 3 years, or both. An administrative penalty may reach BDS $50,000 for specified contraventions after a hearing and public-interest determination. Registration-related offences of BDS $10,000 and 2 months should not be treated as operative without later commencement evidence because sections 50-57 were excluded from the 31 March 2021 proclamation.
Private right of action: The Act provides compensation for proven damage or distress caused by a contravention. It also provides Commissioner complaint and assessment routes, with an appeal against an administrative-penalty order within 28 days. No fixed compensation amount was specified.
Relevance to data brokers
No dedicated data-broker complaint form, broker-specific deletion or suppression route, data-broker registry, or public-record takedown process was located. This means only that the route was not located; it is not a confirmed finding that such a route does not exist. General access, rectification, erasure, restriction, direct-marketing objection, Commissioner complaint, and section 78 assessment routes may apply to a broker or other controller, subject to scope and exemptions.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Barbados’s Data Protection Act fully in force?+
The Act came into operation on 31 March 2021, but the proclamation expressly excluded sections 50, 51, 52, 55, 56 and 57. No later commencement instrument bringing those sections into force was located.
What rights does Barbados’s Data Protection Act provide?+
Subject to exemptions, the Act provides access, rectification, erasure, restriction, portability, direct-marketing objection, protection against specified solely automated decisions, consent withdrawal, complaints, and compensation for proven damage or distress.
Can public-record data be deleted in Barbados?+
Not universally. Personal data that a controller is obliged by or under an enactment to make public is exempt from Parts II, III, IV and VI, which can displace ordinary access, correction, erasure, restriction, and transfer protections. No dedicated public-record takedown process was located.
Official sources & citations
Other international privacy regimes
Data Protection Act 2019-29 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: