The framework
The Bahamas' framework rests on the Data Protection (Privacy of Personal Information) Act 2003, with the Data Protection Commissioner as the supervisory authority.
That puts the Bahamas in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Data Protection (Privacy of Personal Information) Act 2003
An early Caribbean adopter (2003) whose framework now trails the modern Commonwealth Caribbean laws; modernization has been recommended repeatedly.
Marketing and advertising
Directive-era consent-oriented rules. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
The Act places transfers abroad under the Commissioner's supervision.
Enforcement and penalties
Fines are modest. Read the ceiling together with the authority's track record, which prices the risk.