Data Protection Act 2021, comprehensive regime
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Commencement not set.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Before processing personal data of a person in Belize, establish a lawful basis such as consent, a contract with the data subject, or a legal obligation, and process it fairly, transparently, and only for the specified purpose.
- Do not process sensitive personal data, including biometric data such as a voiceprint or faceprint, unless a listed condition applies, such as the data subject's consent or a deliberate act by the data subject making the information public.
- Give a data subject access to, and the ability to correct, erase, restrict, or port, their personal data on request.
- Do not base a decision solely on automated processing, including profiling, that produces a legal or similarly significant effect on a person, unless a contract, an authorising enactment with safeguards, or the person's consent applies, and never for sensitive personal data outside the public interest.
- Stop processing a person's personal data for direct marketing once they object.
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Biometric, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act applies to the processing of personal data by a data controller or processor established in Belize, and to the processing of personal data of data subjects in Belize by a controller or processor established elsewhere where the processing relates to offering goods or services to those data subjects, subject to an exemption for a small business (annual turnover of $3,000,000 or less) that does not extend to a business trading in personal information, providing a health service, or several other listed activities.
Section 4 sets the standard lawfulness, purpose-limitation, and data-minimisation principles, and section 7 requires a lawful basis such as consent, a contract with the data subject, or a legal obligation before processing.
Section 10 prohibits processing sensitive personal data, which includes racial or ethnic origin, religious belief, genetic data, biometric data, and sexual orientation, unless one of a listed set of conditions applies, among them the data subject's consent or a deliberate act by the data subject making the information public; section 9 sets the age of digital consent for a child's own consent at thirteen.
Sections 11 to 18 give a data subject rights of access, rectification, erasure, restriction, and data portability, and a right to prevent processing likely to cause damage or distress or intended for direct marketing.
Section 19 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect, subject to exceptions for a contract, an authorising enactment with safeguards, or the data subject's consent. Section 19(4) withholds those exceptions from sensitive personal data unless the processing is in the public interest with suitable safeguards in place.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsprocesses_voicehigh_risk_decisionsautomated_outreach
Read the law
Official text of the Data Protection Act
2021 (Act No. 45 of 2021), National Assembly of Belize, cited through an Internet Archive capture of the National Assembly's PDF