How Aegis maps to
Caribbean data protection law.

Built from the ground up for the Barbados DPA 2019. Every rule, deadline, and gap analysis flag in the platform references the Act directly — not a GDPR approximation.

The distinction matters. The Barbados DPA has its own legal basis structure (ss.6–12), its own breach notification clock (s.26), its own DSR deadline trigger (from identity verification, not receipt), and its own sector-specific overlays through the FSC. Generic GDPR tools do not handle these correctly. Aegis does.

Any person or organisation — private or public — that processes personal data of individuals in Barbados. This includes all private sector businesses, government ministries, statutory bodies, NGOs, and non-profit organisations operating in or connected to Barbados.

There is no "small business exemption" in the DPA 2019. Size does not determine obligation — if you handle personal data, the Act applies.

The Breach Management module Module 03 starts the 72-hour clock the moment you log an incident — consistent with s.26 of the DPA 2019, which requires notification to the Commissioner from the point of awareness, not from investigation or confirmation.

The module walks you through severity classification, documentation of the breach scope, risk assessment, and generates the Commissioner notification form as a completed Word document. It also handles the FSC's separate 4-hour major incident notification requirement for regulated financial entities, which runs from classification — not from awareness.

Because that is what s.23 of the Barbados DPA 2019 requires. The 30-day response window runs from the date you have verified the requester's identity — not from the date their request was received. This is one of the most commonly misapplied rules in Caribbean compliance practice.

The Data Subject Requests module Module 08 handles this correctly: the deadline clock does not start until identity verification is logged. This protects you from artificially short response windows that inflate non-compliance risk.

Sections 6–12 of the DPA 2019 set out the conditions under which personal data may be lawfully processed. A separate legal basis must be identified for each processing activity. Selecting a single basis and applying it across all processing — or relying on consent as a default — is a compliance error.

Aegis enforces multi-basis selection throughout the platform. The Consent & Legal Basis Register Module 05 and Data Flow Mapping module Module 01 both require a specific basis to be assigned per activity. The gap analysis engine flags any processing activity recorded without a valid basis.

All 11 modules are built around Barbados DPA 2019 obligations as the baseline. The most directly mapped are:

• Module 01 — Data Flow Mapping: Article 4 / accountability obligation — know what you process and why
• Module 02 — ROPA: Records of processing activities — foundational accountability requirement
• Module 03 — Breach Management: s.26 — 72-hour notification to Commissioner; FSC 4-hour rule
• Module 05 — Consent & Legal Basis Register: ss.6–12 — lawful basis per processing activity
• Module 08 — Data Subject Requests: s.22–24 — access, rectification, objection rights; s.23 30-day deadline
• Module 09 — Audit & Evidence Log: Accountability principle — demonstrate compliance to the Commissioner

Yes. The Financial Services Commission of Barbados imposes additional data and cyber incident obligations on licensed financial entities — most notably the 4-hour major incident notification requirement. This runs from the point of classification, not from initial awareness.

The Breach Management module Module 03 handles both the DPA 2019 72-hour Commissioner notification and the FSC 4-hour clock as parallel workflows, generating separate notification documents for each regulator.