Barbados DPA
Data Protection Act 2019 (Act 2019-4)
Barbados' GDPR-aligned data protection law with biometric data definitions, mandatory DPO, and extraterritorial scope.
Jurisdiction
Barbados
Enacted
Mar 11, 2019
Effective
Mar 11, 2021
Enforcement
Data Protection Commissioner
GDPR-aligned framework with extraterritorial application
Parliament of Barbados — Data Protection Act 2019 (Act 2019-4), official text PDFWhy It Matters
Barbados' GDPR-aligned framework with extraterritorial scope creates familiar compliance pathway for European AI companies serving Caribbean markets.
At a Glance
Applies to
Requires
Who Must Comply
- Data controllers and processors in Barbados
- Entities outside Barbados processing data of Barbadian residents
- High-risk processing including biometric data
Safety Provisions
- Biometric data explicitly defined as special category
- Mandatory Data Protection Officer for certain controllers
- Data Protection Impact Assessment for high-risk processing
- Breach notification required
- Extraterritorial application to data of Barbadian residents
Compliance & Enforcement
Penalties
Fines and enforcement actions
View on map
Barbados
Focus Areas
Cite This
APA
Barbados. (2019). Data Protection Act 2019 (Act 2019-4).
Related Regulations
CARICOM CCSCAP 2025
CARICOM's 2025 regional cyber security framework establishing digital safety culture and coordinated incident response across 18 member states.
Chile Cybersecurity Law
First cybersecurity framework law in Latin America (Law 21,663 promulgated Mar 26, 2024; published Apr 8, 2024). Creates National Cybersecurity Agency (ANCI), mandatory incident reporting, and encryption rights.
Puerto Rico Cybersecurity Act
Puerto Rico's comprehensive cybersecurity law establishing cybersecurity framework for public and private sectors, complementing Act 111-2005 breach notification.
Argentina AI Strategy
Non-binding AI governance guidelines establishing principles for responsible AI use. Argentina positioning as AI innovation hub with limited regulatory barriers. Emphasizes transparency, accountability, and human oversight. Multiple legislative proposals pending inspired by EU AI Act, aiming to establish formal regulatory authority.
AIDA
Would have regulated high-impact AI systems with potential penalties up to $25M or 5% global revenue. Part of Bill C-27 which died when Parliament ended.
MX Safe Digital Environments Decree
Mexican presidential decree, binding nationwide, that prohibits digital platforms from giving children and adolescents access to, exposure to or recommendations of seven listed content categories, including suicide, self-harm and eating disorders, and requires age assurance beyond self-declaration, parental supervision tools, strictest-by-default settings for new accounts, periodic risk assessments and a 24/7 law-enforcement contact point.
Last updated September 12, 2026. Verify against primary sources before relying on this information.