Skip to main content
NOPE
In Effect Law Data Protection

Barbados DPA

Data Protection Act 2019 (Act 2019-4)

Barbados' GDPR-aligned data protection law with biometric data definitions, mandatory DPO, and extraterritorial scope.

Jurisdiction

Barbados

Enacted

Mar 11, 2019

Effective

Mar 11, 2021

Enforcement

Data Protection Commissioner

GDPR-aligned framework with extraterritorial application

Barbados Parliament

Why It Matters

Barbados' GDPR-aligned framework with extraterritorial scope creates familiar compliance pathway for European AI companies serving Caribbean markets.

At a Glance

Applies to

AI CompanionMental Health AppGeneral Chatbot

Who Must Comply

  • Data controllers and processors in Barbados
  • Entities outside Barbados processing data of Barbadian residents
  • High-risk processing including biometric data

Obligations fall on:

Safety Provisions

  • Biometric data explicitly defined as special category
  • Mandatory Data Protection Officer for certain controllers
  • Data Protection Impact Assessment for high-risk processing
  • Breach notification required
  • Extraterritorial application to data of Barbadian residents

Compliance & Enforcement

Penalties

Fines and enforcement actions

View on map

Barbados

Focus Areas

Mental health & crisis
Algorithmic accountability

Cite This

APA

Barbados. (2019). Data Protection Act 2019 (Act 2019-4).

Related Regulations

In Effect CARICOM

CARICOM CCSCAP 2025

CARICOM's 2025 regional cyber security framework establishing digital safety culture and coordinated incident response across 18 member states.

In Effect CL

Chile Cybersecurity Law

First cybersecurity framework law in Latin America (Law 21,663 promulgated Mar 26, 2024; published Apr 8, 2024). Creates National Cybersecurity Agency (ANCI), mandatory incident reporting, and encryption rights.

In Effect PR

Puerto Rico Cybersecurity Act

Puerto Rico's comprehensive cybersecurity law establishing cybersecurity framework for public and private sectors, complementing Act 111-2005 breach notification.

In Effect AR

Argentina AI Strategy

Non-binding AI governance guidelines establishing principles for responsible AI use. Argentina positioning as AI innovation hub with limited regulatory barriers. Emphasizes transparency, accountability, and human oversight. Multiple legislative proposals pending inspired by EU AI Act, aiming to establish formal regulatory authority.

Failed CA

AIDA

Would have regulated high-impact AI systems with potential penalties up to $25M or 5% global revenue. Part of Bill C-27 which died when Parliament ended.

In Effect BR

Brazil ECA Digital

Comprehensive child digital safety law applying to any IT product or service directed at or likely to be accessed by minors in Brazil, with extraterritorial reach.

All regulations Check if this applies to you

Last updated January 22, 2026. Verify against primary sources before relying on this information.