BarbadosData Protection Act, 2019, the Commissioner, enforcement and penalties
Data Protection Act, 2019, ss. 70-95 (Commissioner, enforcement, tribunal and penalties)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 26 March 2021.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Comply with an enforcement notice the Commissioner serves within the time it specifies, including any requirement to stop processing personal data or a description of personal data, because failing to comply with a notice is itself an offence.
- Answer an information notice or a special information notice from the Commissioner, and do not obstruct the execution of a warrant issued under the Act.
- Expect an individual who suffers damage or distress from a contravention to be able to claim compensation from you, and expect to have to prove you took all the measures reasonably required to comply in order to defend the claim.
- Expect the Commissioner to be able to order an administrative penalty of up to $50,000 after a hearing for contravening the registration-change, records, cooperation, security, breach-notification, impact-assessment, prior-consultation or data-privacy-officer duties, on top of the Act's criminal fines.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A person who contravenes the data-processing principles in section 4 is guilty of an offence and is liable on summary conviction to a fine of $500,000 or to imprisonment for three years, or to both; the same fine and term apply to a contravention of the cross-border-transfer duties in sections 22 to 24.
Penalty structure
Fine for contravening the data-processing principles (s. 4) or the cross-border-transfer duties (ss. 22-24); the Act sets separate, lower fixed fines for narrower failures such as operating as an unregistered data controller or processor, ranging from $10,000 to $100,000, each with an alternative or concurrent prison term.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- BBD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Data Protection Commissioner
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Sections 70 to 75 establish the Data Protection Commissioner and set the Commissioner's functions, staff, duties of confidence, indemnity and reporting.
Section 76 lets the Commissioner, on being satisfied that a data controller or data processor has contravened or is contravening the Act, serve an enforcement notice requiring steps to be taken or refrained from within a specified time, or requiring processing to stop, having considered whether the contravention has caused or is likely to cause damage or distress; sections 77 to 82 govern cancellation of a notice, requests for assessment, information notices, special information notices and the journalism restriction.
Section 83 makes failure to comply with a notice an offence, and sections 84 to 89 govern service, warrants, their execution and return, matters exempt from inspection and seizure, and obstruction. Sections 90 to 92 establish the Data Protection Tribunal and the right of appeal against the Commissioner's notices and its determination.
Section 93 entitles an individual who suffers damage or distress from any contravention of the Act to compensation from the data controller or data processor, subject to the defence of having taken all measures reasonably required to comply.
Section 94 makes it an offence to obtain, disclose or procure the disclosure of personal data knowingly or recklessly without the data controller's consent, carrying a fine of $10,000 or six months' imprisonment or both, rising to $100,000 or three years where the personal data so obtained is sold or offered for sale.
Section 95 lets the Commissioner, after a hearing and where the public interest calls for it, order a person who has contravened section 52(1), section 57(1) or sections 60 to 67 to pay the Crown a penalty of up to $50,000. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisions
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.