DPA in The Bahamas has only limited extraterritorial effect (as it concerns data controllers). Per Section 4(1) of DPA, the Act only applies to: data controllers established in The Bahamas (where the data is processed in the context of the local establishment); and data controllers established outside The Bahamas that use equipment in The Bahamas for processing data (other than for transit through The Bahamas). 

In the above context, an ‘established’ data controller can be any of the following (in accordance with Section 4(3) of DPA): an individual ordinarily resident in The Bahamas; a body incorporated or registered under Bahamian law; a partnership or other unincorporated association formed under Bahamian law; and any person that does not fall into any of the foregoing categories but maintains an office, branch or agency in The Bahamas through which they carry on a business activity or regular practice. It can be seen, therefore, that a nexus to The Bahamas of the kind described above must be established for DPA to apply outside the jurisdiction. 

Data controllers are defined in Section 2 DPA as a person who, alone or with others, determines the purposes for which and the manner in which any personal data are, or are to be processed. Data controllers owe a statutory duty of care to data subjects pursuant to Section 12(1) as it regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data. Further, Section 12(2) provides that data controllers must use contractual or other legal means to provide a ‘comparable’ level of protection from any third party to whom he discloses information for the purpose of data processing. 

Data controllers, under Sections 6(1), must abide by several core duties as it relates that the collection, processing, keeping, use and disclosure of data of data subjects, namely, to ensure:

• The data or information constituting the data has been collected by means which are lawful and fair in the circumstances of the case (e.g., data subjects should not be deceived or misled as to the purpose(s) for which the data is being processed or collected – and the use of such data should not cause damage or distress to the data subject);
• The data is accurate and kept up to date where necessary (except in the case of data back-up);
• The data is only kept only for one or more specified or lawful purpose(s);
• The data is not used or disclosed in a manner which is incompatible with that/those purpose(s);
• The data collected is adequate, relevant and not excessive in relation to that purpose or purposes;
• The data is not kept for a period longer than necessary for the purpose(s) for which it was collected (except in cases where personal data needs to be kept for historical, statistical or research purposes);
• There are appropriate security measures in place to prevent unauthorised access to, or alteration, disclosure or destruction of data and against its accidental loss or destruction.