The Data Protection Act 2019 of Barbados establishes a comprehensive framework for the protection of personal data within the jurisdiction. This analysis will focus on the applicability of the Act, examining both its material and territorial scope.

Territorial Applicability Factors

The Data Protection Act 2019 of Barbados employs several factors to determine its territorial applicability:

1. Processing in Context of Local Establishment
2. Processing by Entity Registered or Incorporated in Jurisdiction
3. Entity's Link or Presence in Jurisdiction
4. Offering Goods and Services to Data Subjects in Jurisdiction

Let's examine each of these factors in detail.

Processing in Context of Local Establishment

The Act applies to data processing activities carried out by entities established in Barbados. Article 3(1)(a) of the Act states:

Data Protection Act 2019 Art.3(1)(a):

"This Act applies to (a) the processing of personal data in the context of the activities of a data controller or a data processor established in Barbados;"

The Act provides a broad definition of what constitutes being "established in Barbados" in Article 3(2):

Data Protection Act 2019 Art.3(2):

"For the purposes of subsection (1) "established in Barbados" means(a) an individual who is ordinarily resident in Barbados;(b) a body, association or other entity incorporated, organised, registered or otherwise formed under any enactment; or(c) a person who does not fall within paragraph (a) or (b) but maintains in Barbados an office, branch or agency through which he carries on any activity related to the processing of personal data."

This definition ensures that the Act covers a wide range of entities with a significant presence or connection to Barbados, including individuals who are ordinarily resident, legally incorporated entities, and foreign entities with a local presence engaged in data processing activities.

Processing by Entity Registered or Incorporated in Jurisdiction

The Act explicitly applies to entities that are legally incorporated or registered in Barbados. As stated in Article 3(2)(b), this includes any "body, association or other entity incorporated, organised, registered or otherwise formed under any enactment" in Barbados.

This provision ensures that all companies formally established under Barbadian law are subject to the Act's requirements, regardless of where the actual data processing takes place.

Entity's Link or Presence in Jurisdiction

The Act extends its applicability to entities that maintain a presence in Barbados for data processing purposes, even if they are not formally incorporated or resident in the country. Article 3(2)(c) covers "a person who does not fall within paragraph (a) or (b) but maintains in Barbados an office, branch or agency through which he carries on any activity related to the processing of personal data."

This provision broadens the scope of the law to include foreign entities that have established a physical presence in Barbados for data processing activities.

Offering Goods and Services to Data Subjects in Jurisdiction

The Act also applies to entities not established in Barbados if they process personal data of Barbadian residents in relation to offering goods or services. Article 3(1)(b) states:

Data Protection Act 2019 Art.3(1)(b):

"This Act applies to (b) the processing of personal data of data subjects in Barbados by a data controller or a data processor not established in Barbados, where the processing activities are related to the offering of goods or services to data subjects in Barbados."

This provision extends the territorial scope of the Act beyond Barbados' borders, ensuring that foreign entities targeting the Barbadian market must comply with the Act's requirements.

Conclusion

The Data Protection Act 2019 of Barbados has a broad territorial scope, covering not only entities established in Barbados but also foreign entities that process data of Barbadian residents when offering goods or services.