Data Protection Act 2003, application and processing principles
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 2 April 2007.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Collect personal data only by means that are lawful and fair, keep it accurate and up to date, and hold it only for the specified purposes it was collected for.
- Give an individual access to personal data held about them within forty days of a written request, and rectify or erase it on request where it breaches the collection principles.
- Stop using an individual's personal data for direct marketing within forty days of their written request.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act binds a data controller established in The Bahamas, or one using equipment there to process data, to collect personal data by lawful and fair means, keep it accurate and up to date, hold it only for specified purposes, and secure it against unauthorised access. An individual may request access to personal data held about them within forty days. An individual may also have inaccurate data rectified or erased on written request.
An individual may require a controller to stop using their data for direct marketing. The Act does not apply to personal data kept for national security, information a controller is required by law to publish, an individual's own personal or household affairs, or pending legal proceedings.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
Data Protection (Privacy of Personal Information) Act, Chapter 324A, Statute Law of The Bahamas