Meet Bahamas DPA obligations with evidence you can stand behind

The Bahamas Data Protection Act is the Data Protection (Privacy of Personal Information) Act, 2003, Chapter 324A of the laws of The Bahamas. It protects the privacy of living individuals by setting rules for how data controllers collect, process, keep, use and disclose personal data, and it gives individuals rights to access and correct their data. The Data Protection Commissioner enforces it through investigations and enforcement, prohibition and information notices.

Data controllers established in The Bahamas must comply. That includes individuals ordinarily resident there, bodies incorporated or registered under Bahamian law, and organisations with an office, branch or agency in The Bahamas. Controllers established elsewhere are also caught when they use equipment in The Bahamas to process personal data, other than for transit. There is no requirement to register with the Commissioner or to appoint a data protection officer.

Under section 29, a person guilty of an offence is liable on summary conviction to a fine of up to B$2,000, or on conviction on information to a fine of up to B$100,000. The court can also order connected data material to be forfeited or destroyed and relevant data erased. The Commissioner can additionally issue enforcement notices and prohibit transfers of personal data outside The Bahamas.

Section 6 requires data controllers to collect personal data lawfully and fairly, keep it accurate and up to date, hold it only for specified and lawful purposes, avoid incompatible use or disclosure, keep it adequate, relevant and not excessive, retain it no longer than necessary, and protect it with appropriate security measures against unauthorised access, alteration, disclosure, destruction or accidental loss.

Individuals can request access to personal data a controller holds about them, ask for inaccurate data to be rectified or erased, and require a controller to stop using their data for direct marketing. For direct marketing objections, the controller has no more than 40 days to erase or stop using the data and confirm this in writing. Individuals can also complain to the Data Protection Commissioner.

The Bahamas DPA shares core principles with GDPR, such as purpose limitation, accuracy, data minimisation and storage limitation, but it is narrower: it has no breach notification duty, no DPO requirement and no registration. Its security requirement in section 6 is commonly met with an information security programme such as ISO 27001, so controls and evidence built for those frameworks can support Bahamas DPA compliance.

Yes, a replacement is on the way. The Government of The Bahamas tabled the Data Protection Bill, 2025, a broader law intended to repeal and replace the 2003 Act, with transitional provisions so organisations have time to comply before full enforcement. Until the new law is brought into force, the 2003 Act remains the operative law, so organisations should comply with it while preparing for the stronger requirements.

Yes. OneClickComply supports the Bahamas Data Protection Act today. Its requirements share controls with frameworks such as GDPR and ISO 27001, so evidence you collect for those counts here too. OneClickComply automates evidence collection, generates policies from your real environment and monitors controls continuously, with an in-house audit team to answer questions. It does not certify compliance with the Act.