Jurisdiction dossier
Barbados: AI regulation & deadlines
Section 18 of the Data Protection Act, 2019-29 is headed «Automated individual decision-making, including profiling» and reproduces GDPR art. 22 almost word for word. Section 18(1): «The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or similarly significantly affects him.» Section 18(2) disapplies that where the automated processing or profiling is (a) «necessary for entering into, or performance of, a contract between the data subject and a data controller»; (b) «authorised by any enactment to which the data controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests»; or (c) «based on the data subject's consent». Section 18(3) then requires that in the (a) and (c) cases — contract and consent, not the statutory-authorisation case, which carries its own safeguards on the face of (b) — the controller «shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests».
Section 18(4) is where Barbados departs from the European text and goes further: «Subsection (2) shall not apply to sensitive personal data unless it is in the public interest and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.» GDPR art. 22(4) permits solely-automated processing of special-category data on explicit consent or substantial public interest; the Barbadian provision drops the consent route entirely, so no amount of consent will license a solely-automated significant decision on sensitive personal data in Barbados. Read with s. 18(2)(c), the result is that consent unlocks automation for ordinary personal data and never for sensitive personal data.
The transparency limb is proactive and cross-referenced, unlike the reactive access-only limb in Zambia. Both s. 19 (information to be provided where personal data is collected from the data subject) and s. 20 (where it has not been so obtained) require the controller to give «the existence of automated decision-making, including profiling, referred to in section 18 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject» — at the time the data is obtained, without a request and without a fee. Section 19(3) extends the duty to further processing for a new purpose. «Profiling» is defined in s. 2 in GDPR terms as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.
Section 100 of the Act is a bare enabling clause — «This Act comes into operation on a date to be fixed by proclamation» — and the face of the Act carries only «[Commencement: by Proclamation]», so the 12 August 2019 assent printed in Official Gazette No. 66 is not the operative date and must not be carried as one. The Act was proclaimed in late March 2021 and brought into operation on 31 March 2021, excepting the controller/processor registration provisions at ss. 50, 51, 52, 55, 56 and 57, which were held back. **The proclamation instrument itself has not been read on this box**: the Barbados Official Gazette issue carrying it is not exposed on `oag.gov.bb`, `gisbarbados.gov.bb` or `barbadosparliament.com` in a form reachable from here, and the 31 March 2021 date and the excepted-section list come from consistent secondary reporting rather than from the gazette. Confidence is held at medium on that ground alone; the text of s. 18 is verified verbatim against the Act as published by the Office of the Attorney General and is not in doubt.
The exception list is not idle detail — it interacts directly with the penalty position. Section 95(1) confines the Commissioner's administrative penalty to contraventions of s. 52(1), s. 57(1) and ss. 60 to 67, and two of those three named sections (52 and 57) are among the provisions withheld from the proclamation, which narrows the administrative route further still. Section 18 is not in the withheld list and has been in operation since 31 March 2021. To close the gap, obtain the March 2021 Barbados Official Gazette proclamation and confirm the excepted sections by number; that would move confidence to high without changing the date.
No offence and no administrative penalty attaches to s. 18 itself, and the reason is structural. Section 95(1) empowers the Commissioner, after a hearing and where he considers it in the public interest, to order a person who «has contravened section 52(1), section 57(1) and sections 60 to 67» to pay the Crown a penalty not exceeding BBD 50,000, with the s. 95(2) quantum factors (nature, gravity and duration; intent or negligence; mitigation; previous contraventions; cooperation; categories of data affected; self-notification) tracking GDPR art. 83(2). Section 18 is outside that enumerated list, so the administrative fine cannot reach it.
The operative route is the enforcement notice. Section 75(1) lets the Commissioner, where satisfied that a controller or processor «has contravened or is contravening this Act» — the whole Act, not a subset — serve a notice requiring specified steps to be taken or refrained from, or requiring the person to stop processing altogether; s. 75(2) requires him to consider whether the contravention has caused or is likely to cause damage or distress, and s. 75(3) requires the notice to state the provision contravened and the s. 91 appeal right. Disobedience is then an offence: s. 83(1) provides that a person who fails to comply with an enforcement notice, an information notice or a special information notice is guilty of an offence and liable on summary conviction to a fine of BBD 15,000 or to imprisonment for 6 months, with a due-diligence defence at s. 83(3); a knowing or reckless false statement in purported compliance with an information notice carries BBD 500,000 or 3 years under s. 83(2). A data subject also has a free-standing civil claim under s. 93 (right to compensation and liability) and an appeal to the Data Protection Tribunal established under s. 90. Impact tier: all entities. 1 obligation tracked — 1 in force.
◆Binding — Binding sectoral
Flagship law: Data Protection Act 2019-29 s. 18
Section 18 of the Data Protection Act, 2019-29 is headed «Automated individual decision-making, including profiling» and reproduces GDPR art. 22 almost word for word. Section 18(1): «The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or similarly significantly affects him.» Section 18(2) disapplies that where the automated processing or profiling is (a) «necessary for entering into, or performance of, a contract between the data subject and a data controller»; (b) «authorised by any enactment to which the data controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests»; or (c) «based on the data subject's consent». Section 18(3) then requires that in the (a) and (c) cases — contract and consent, not the statutory-authorisation case, which carries its own safeguards on the face of (b) — the controller «shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests».
Section 18(4) is where Barbados departs from the European text and goes further: «Subsection (2) shall not apply to sensitive personal data unless it is in the public interest and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.» GDPR art. 22(4) permits solely-automated processing of special-category data on explicit consent or substantial public interest; the Barbadian provision drops the consent route entirely, so no amount of consent will license a solely-automated significant decision on sensitive personal data in Barbados. Read with s. 18(2)(c), the result is that consent unlocks automation for ordinary personal data and never for sensitive personal data.
The transparency limb is proactive and cross-referenced, unlike the reactive access-only limb in Zambia. Both s. 19 (information to be provided where personal data is collected from the data subject) and s. 20 (where it has not been so obtained) require the controller to give «the existence of automated decision-making, including profiling, referred to in section 18 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject» — at the time the data is obtained, without a request and without a fee. Section 19(3) extends the duty to further processing for a new purpose. «Profiling» is defined in s. 2 in GDPR terms as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.
Section 100 of the Act is a bare enabling clause — «This Act comes into operation on a date to be fixed by proclamation» — and the face of the Act carries only «[Commencement: by Proclamation]», so the 12 August 2019 assent printed in Official Gazette No. 66 is not the operative date and must not be carried as one. The Act was proclaimed in late March 2021 and brought into operation on 31 March 2021, excepting the controller/processor registration provisions at ss. 50, 51, 52, 55, 56 and 57, which were held back. **The proclamation instrument itself has not been read on this box**: the Barbados Official Gazette issue carrying it is not exposed on `oag.gov.bb`, `gisbarbados.gov.bb` or `barbadosparliament.com` in a form reachable from here, and the 31 March 2021 date and the excepted-section list come from consistent secondary reporting rather than from the gazette. Confidence is held at medium on that ground alone; the text of s. 18 is verified verbatim against the Act as published by the Office of the Attorney General and is not in doubt.
The exception list is not idle detail — it interacts directly with the penalty position. Section 95(1) confines the Commissioner's administrative penalty to contraventions of s. 52(1), s. 57(1) and ss. 60 to 67, and two of those three named sections (52 and 57) are among the provisions withheld from the proclamation, which narrows the administrative route further still. Section 18 is not in the withheld list and has been in operation since 31 March 2021. To close the gap, obtain the March 2021 Barbados Official Gazette proclamation and confirm the excepted sections by number; that would move confidence to high without changing the date.
No offence and no administrative penalty attaches to s. 18 itself, and the reason is structural. Section 95(1) empowers the Commissioner, after a hearing and where he considers it in the public interest, to order a person who «has contravened section 52(1), section 57(1) and sections 60 to 67» to pay the Crown a penalty not exceeding BBD 50,000, with the s. 95(2) quantum factors (nature, gravity and duration; intent or negligence; mitigation; previous contraventions; cooperation; categories of data affected; self-notification) tracking GDPR art. 83(2). Section 18 is outside that enumerated list, so the administrative fine cannot reach it.
The operative route is the enforcement notice. Section 75(1) lets the Commissioner, where satisfied that a controller or processor «has contravened or is contravening this Act» — the whole Act, not a subset — serve a notice requiring specified steps to be taken or refrained from, or requiring the person to stop processing altogether; s. 75(2) requires him to consider whether the contravention has caused or is likely to cause damage or distress, and s. 75(3) requires the notice to state the provision contravened and the s. 91 appeal right. Disobedience is then an offence: s. 83(1) provides that a person who fails to comply with an enforcement notice, an information notice or a special information notice is guilty of an offence and liable on summary conviction to a fine of BBD 15,000 or to imprisonment for 6 months, with a due-diligence defence at s. 83(3); a knowing or reckless false statement in purported compliance with an information notice carries BBD 500,000 or 3 years under s. 83(2). A data subject also has a free-standing civil claim under s. 93 (right to compensation and liability) and an appeal to the Data Protection Tribunal established under s. 90. Impact tier: all entities.
Questions & answers
From the data
When does Data Protection Act 2019-29 s. 18 take effect in Barbados?
Data Protection Act 2019-29 s. 18 is already in force, with obligations live since March 31, 2021. Section 18 of the Data Protection Act, 2019-29 is headed «Automated individual decision-making, including profiling» and reproduces GDPR art. 22 almost word for word. Section 18(1): «The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or similarly significantly affects him.» Section 18(2) disapplies that where the automated processing or profiling is (a) «necessary for entering into, or performance of, a contract between the data subject and a data controller»; (b) «authorised by any enactment to which the data controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests»; or (c) «based on the data subject's consent». Section 18(3) then requires that in the (a) and (c) cases — contract and consent, not the statutory-authorisation case, which carries its own safeguards on the face of (b) — the controller «shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests».
Section 18(4) is where Barbados departs from the European text and goes further: «Subsection (2) shall not apply to sensitive personal data unless it is in the public interest and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.» GDPR art. 22(4) permits solely-automated processing of special-category data on explicit consent or substantial public interest; the Barbadian provision drops the consent route entirely, so no amount of consent will license a solely-automated significant decision on sensitive personal data in Barbados. Read with s. 18(2)(c), the result is that consent unlocks automation for ordinary personal data and never for sensitive personal data.
The transparency limb is proactive and cross-referenced, unlike the reactive access-only limb in Zambia. Both s. 19 (information to be provided where personal data is collected from the data subject) and s. 20 (where it has not been so obtained) require the controller to give «the existence of automated decision-making, including profiling, referred to in section 18 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject» — at the time the data is obtained, without a request and without a fee. Section 19(3) extends the duty to further processing for a new purpose. «Profiling» is defined in s. 2 in GDPR terms as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.
Section 100 of the Act is a bare enabling clause — «This Act comes into operation on a date to be fixed by proclamation» — and the face of the Act carries only «[Commencement: by Proclamation]», so the 12 August 2019 assent printed in Official Gazette No. 66 is not the operative date and must not be carried as one. The Act was proclaimed in late March 2021 and brought into operation on 31 March 2021, excepting the controller/processor registration provisions at ss. 50, 51, 52, 55, 56 and 57, which were held back. **The proclamation instrument itself has not been read on this box**: the Barbados Official Gazette issue carrying it is not exposed on `oag.gov.bb`, `gisbarbados.gov.bb` or `barbadosparliament.com` in a form reachable from here, and the 31 March 2021 date and the excepted-section list come from consistent secondary reporting rather than from the gazette. Confidence is held at medium on that ground alone; the text of s. 18 is verified verbatim against the Act as published by the Office of the Attorney General and is not in doubt.
The exception list is not idle detail — it interacts directly with the penalty position. Section 95(1) confines the Commissioner's administrative penalty to contraventions of s. 52(1), s. 57(1) and ss. 60 to 67, and two of those three named sections (52 and 57) are among the provisions withheld from the proclamation, which narrows the administrative route further still. Section 18 is not in the withheld list and has been in operation since 31 March 2021. To close the gap, obtain the March 2021 Barbados Official Gazette proclamation and confirm the excepted sections by number; that would move confidence to high without changing the date.
No offence and no administrative penalty attaches to s. 18 itself, and the reason is structural. Section 95(1) empowers the Commissioner, after a hearing and where he considers it in the public interest, to order a person who «has contravened section 52(1), section 57(1) and sections 60 to 67» to pay the Crown a penalty not exceeding BBD 50,000, with the s. 95(2) quantum factors (nature, gravity and duration; intent or negligence; mitigation; previous contraventions; cooperation; categories of data affected; self-notification) tracking GDPR art. 83(2). Section 18 is outside that enumerated list, so the administrative fine cannot reach it.
The operative route is the enforcement notice. Section 75(1) lets the Commissioner, where satisfied that a controller or processor «has contravened or is contravening this Act» — the whole Act, not a subset — serve a notice requiring specified steps to be taken or refrained from, or requiring the person to stop processing altogether; s. 75(2) requires him to consider whether the contravention has caused or is likely to cause damage or distress, and s. 75(3) requires the notice to state the provision contravened and the s. 91 appeal right. Disobedience is then an offence: s. 83(1) provides that a person who fails to comply with an enforcement notice, an information notice or a special information notice is guilty of an offence and liable on summary conviction to a fine of BBD 15,000 or to imprisonment for 6 months, with a due-diligence defence at s. 83(3); a knowing or reckless false statement in purported compliance with an information notice carries BBD 500,000 or 3 years under s. 83(2). A data subject also has a free-standing civil claim under s. 93 (right to compensation and liability) and an appeal to the Data Protection Tribunal established under s. 90. Impact tier: all entities.
Who must comply with AI rules in Barbados?
Current obligations bind, among others, Every data controller and data processor within the Act's territorial reach, with no size, turnover or sector threshold — enterprise, SME and public body alike. The hiring, credit and insurance cases are the paradigm: the s. 2 profiling definition covers evaluation of personal aspects relating to a natural person, and an automated sift or score producing a hiring, lending or underwriting outcome both «produces legal effects» or at least «similarly significantly affects» the individual within s. 18(1).
Two features are worth separating from the European original. First, s. 18(4) makes the sensitive-personal-data case categorically harder than under the GDPR, because the consent route is removed rather than tightened — a controller running automated health, biometric, trade-union or similar profiling in Barbados needs a public-interest justification, not a signature. Second, the s. 19/20 disclosure duty is drafted as a collection-time obligation rather than as an access right, so it binds a controller that has never received a data-subject request; the trigger is obtaining the data, not being asked about it. A decision with a human materially in the loop is outside s. 18 entirely — the section reaches only decisions «based solely on» automated processing.. Scope and thresholds vary per instrument — see each row's source for the legal text.
What are the penalties for AI non-compliance in Barbados?
Stated statutory maxima include: Data Protection Act 2019-29 s. 18 — No offence and no administrative penalty attaches to s. 18 itself, and the reason is structural. Section 95(1) empowers the Commissioner, after a hearing and where he considers it in the public interest, to order a person who «has contravened section 52(1), section 57(1) and sections 60 to 67» to pay the Crown a penalty not exceeding BBD 50,000, with the s. 95(2) quantum factors (nature, gravity and duration; intent or negligence; mitigation; previous contraventions; cooperation; categories of data affected; self-notification) tracking GDPR art. 83(2). Section 18 is outside that enumerated list, so the administrative fine cannot reach it.
The operative route is the enforcement notice. Section 75(1) lets the Commissioner, where satisfied that a controller or processor «has contravened or is contravening this Act» — the whole Act, not a subset — serve a notice requiring specified steps to be taken or refrained from, or requiring the person to stop processing altogether; s. 75(2) requires him to consider whether the contravention has caused or is likely to cause damage or distress, and s. 75(3) requires the notice to state the provision contravened and the s. 91 appeal right. Disobedience is then an offence: s. 83(1) provides that a person who fails to comply with an enforcement notice, an information notice or a special information notice is guilty of an offence and liable on summary conviction to a fine of BBD 15,000 or to imprisonment for 6 months, with a due-diligence defence at s. 83(3); a knowing or reckless false statement in purported compliance with an information notice carries BBD 500,000 or 3 years under s. 83(2). A data subject also has a free-standing civil claim under s. 93 (right to compensation and liability) and an appeal to the Data Protection Tribunal established under s. 90. Impact tier: all entities.. These are the maximum amounts in the instruments; actual enforcement is at the regulator's discretion.
Not legal advice. Each obligation links to its primary source and carries the date it was last checked; verify the legal text before relying on it.