Data Protection Act 2003, Commissioner, enforcement and penalties
Data Protection (Privacy of Personal Information) Act Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 2 April 2007.
An enforcement supervision rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Do not disclose personal data processed on behalf of a data controller without that controller's prior authority.
- Do not obtain access to, or disclose, personal data without the authority of the data controller or data processor who holds it.
- Comply with an enforcement notice the Data Protection Commissioner serves requiring rectification, erasure or another specified step.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorised disclosure by a data processor (section 22(2)) and obtaining or disclosing personal data without authority (section 23(1)) are each an offence. Every offence under the Act, including these and failing to comply with an enforcement or information notice, is liable on summary conviction to a fine not exceeding two thousand dollars, or on conviction on information to a fine not exceeding one hundred thousand dollars (section 29(1)); no term of imprisonment is specified.
Penalty structure
Section 29(1) caps every offence under the Act at a fine not exceeding two thousand dollars on summary conviction, or one hundred thousand dollars on conviction on information; no imprisonment term is stated for any offence under this Act.
- Rule
- Fixed only
- As of
- 7 September 2026
- Currency
- BSD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Data Protection Commissioner
What it reaches
Obligation class
Disclosure, Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Data Protection Commissioner, a corporation sole, investigates complaints and may serve an enforcement notice requiring a data controller or processor to rectify or erase data or otherwise comply with the Act. A data processor who discloses personal data without the controller's prior authority, and a person who obtains or discloses personal data without authority, each commit an offence.
A person guilty of any offence under the Act is liable on summary conviction to a fine not exceeding two thousand dollars, or on conviction on information to a fine not exceeding one hundred thousand dollars; the Act specifies no term of imprisonment for any offence.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot
Read the law
Data Protection (Privacy of Personal Information) Act, Chapter 324A, Statute Law of The Bahamas