--- title: "BZ Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/bz-data-protection-privacy-regulation/ source_html: /jurisdictions/belize/index.html description: "BZ data protection and privacy regulation: 10 categories, 16 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 30a584b0b4128247cf161a18154f009fb7cee5b985169a5e8ca151f749cacdb0 generator: "fe-fleet/md-twin@1.0" --- # BZ Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # BZ Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) Last updated 2026-10-25 · 10 categories · 16 claims · 15 sources in the cumulative register Download report (PDF) Expand all A draft National Data and Statistical Systems Act, 2026 was briefed to Belize's National Statistical System agencies on 25 August 2026, with technical support reported from UNDP and KOICA. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=BELIZE)[Build Report](/reports/?j=BELIZE)[Compare](/compare/?j=BELIZE) Framework posture Regulated (omnibus) 8 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Information and Data Protection Commission Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 8 / 10 modules assessed 0 Confirmed · 7 Probable · 1 Uncertain · 2 Not yet assessed 10 Categories 5 Red categories 58 Sub-modules 16 Claims 0 Tier-1 sources Traffic-light mix 3 amber 5 red 2 n/a (sums to 10 rendered categories; click to filter) 5 categories flagged red ## Jurisdiction lead brief Standing brief, as of 25 October 2026. #### Lead Signal A draft National Data and Statistical Systems Act, 2026 was briefed to Belize's National Statistical System agencies on 25 August 2026, with technical support reported from UNDP and KOICA. The draft Act is intended to govern the production, sharing, protection and use of statistical data across the National Statistical System and remains at the consultation and drafting stage; it does not supersede the existing Data Protection Act, 2021, which continues as Belize's sole comprehensive data-protection instrument. This is a sectoral development rather than a change to the general data-protection regime, and it should be read as a distinct statistical-data governance track running in parallel to, rather than displacing, the omnibus Act. #### Other Developments The drafting process is reported as still active as of late August 2026, with the Statistical Institute of Belize reported as the agency pushing the new law forward to modernise the jurisdiction's statistical system. No finalisation date, enactment date, or further legislative stage beyond the briefing to agencies has been confirmed. #### Cross-Monitor Connections A statistical-data governance framework of this kind can intersect with financial-integrity reporting obligations and with payments-sector data-sharing arrangements tracked elsewhere in this fleet, particularly where statistical data collection touches financial-sector reporting. No specific cross-reference to either of those domains was identified in the material located, and the draft Act's relationship to sector-specific reporting obligations elsewhere in Belize's regulatory architecture remains to be clarified as the drafting process proceeds. #### Outlook The National Data and Statistical Systems Act, 2026 is not expected to reach finalisation in the near term; the material located anticipates further progress only around the second quarter of 2027, and that date carries a wide uncertainty band. Until the draft Act advances beyond consultation and drafting, the Data Protection Act, 2021 remains the only instrument governing personal-data processing generally in Belize, with this sectoral initiative developing alongside it rather than in place of it. Read full brief · 320 words Key regulatory facts for BZ Regulatory Dimension BZ Standing Position Jurisdiction BZ (BZ) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 16 sourced findings) Regulator & Framework A comprehensive statute and named regulator are confirmed via secondary/bill sources, but primary-instrument verification (gazette, commencement order, confirmed Bill passage) is outstanding. Lawful Processing & Special Data Comprehensive gap — searches returned only structural/institutional provisions, not the substantive processing-conditions text. Data Subject Rights One sub-module (rectification) is evidenced directly from bill text; the remaining four sub-modules carry no sourced findings. Controller/Processor Duties Full-module gap across all seven declared sub-modules; only institutional/Commission-powers text (routed to regulator_and_framework/enforcement_and_redress) was retrievable. Primary Instruments Cited National Assembly of Belize, Breaking Belize News, Government of Belize Digital Agenda, University of the West Indies, DiploFoundation Last Confirmed / Updated 2026-10-25 (15 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### BZ: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A comprehensive statute and named regulator are confirmed via secondary/bill sources, but primary-instrument verification (gazette, commencement order, confirmed Bill passage) is outstanding. Primary framework Data Protection Act (Cap. 43:14, Laws of Belize) — subject to proposed repeal and re-enactment under the Data Protection Bill, 2024 (Bill No. 19 of 2024) Supervisory authority Information and Data Protection Commission Traffic-light rationale — Amber A comprehensive statute and named regulator are confirmed via secondary/bill sources, but primary-instrument verification (gazette, commencement order, confirmed Bill passage) is outstanding. #### Sub-modules (5) #### Regulator And AuthorityAmber The Information and Data Protection Commission is constituted as a public office consisting of a Commissioner and such Deputy Commissioners and officers as necessary, and is given information-production, audit, and contravention-notice powers under the 2024 reform Bill. Claims (4): - Data Protection Act 2021, ss.61-62 — Requires notification of a personal-data breach to the Commissioner and, separately, to the data subject; the exact deadline figure was not confirmed against the primary Act text this cycle (a secondary source cites a 3-day default, unverified here). - Data Protection Commissioner — Data Protection Act, 2021, s.68, as a public officer in the Ministry responsible for digital transformation/e-governance/IT - Office of the Data Protection Commissioner (Belize) — Established under s.68 of the Data Protection Act 2021, with functions under s.69. #### Act And InstrumentsAmber Cap. 43:14 is the current operative instrument; the 2024 Bill would repeal and re-enact it with transitional/savings provisions preserving continuity of decisions, proceedings and administrative structures. Claims (4): - Office of the Data Protection Commissioner (Belize) — Established under s.68 of the Data Protection Act 2021, with functions under s.69. - National Data and Statistical Systems Act, 2026 (draft) — Consultation/drafting; briefed to National Statistical System agencies 25 August 2026; does not supersede the Data Protection Act, 2021 #### Material ScopeRed No sourced text establishing the precise material-scope test (what data/processing is caught) under Cap. 43:14 or the 2024 Bill was located in this pass. #### Territorial ScopeRed No sourced text establishing an extraterritorial/targeting-and-monitoring test analogous to GDPR Art 3(2) was located for Belize. Claims (1): - Data Protection Act, 2021 — Applies to processing by controllers/processors established in Belize, and to non-established controllers/processors offering goods or services to Belize data subjects. #### Regulator Registration And FilingRed No sourced provision on controller registration, notification, or fee obligations to the Commission was located. #### Regulator & Framework Belize's data protection framework is established by the Data Protection Act, 2021, enacted as Act No. 45 of 2021. The Act was assented to by the Governor-General on 29 November 2021 and gazetted the following day, 30 November 2021, dates confirmed directly from the National Assembly of Belize's own published text. The Act establishes a Data Protection Commissioner under section 68, who is given responsibility for the Act's general administration, positioning the Commissioner as the central regulatory authority for data protection matters in Belize, with the Commissioner's office housed within the Ministry responsible for digital transformation and e-governance. The Act's territorial scope extends beyond entities physically established in Belize. Under section 3, it applies to controllers and processors established in Belize in the ordinary course, but it also reaches extraterritorially to processing of Belize data subjects' personal data undertaken by non-established controllers or processors who offer goods or services to those data subjects, a formulation confirmed from a primary Government of Belize source and structurally comparable to the extraterritorial reach found in the EU General Data Protection Regulation and comparable Caribbean and Latin American omnibus statutes. This means an entity with no physical or corporate presence in Belize can nonetheless fall within the Act's scope purely by virtue of offering goods or services to persons located in Belize. What remains unconfirmed this cycle is the operational status of the Commissioner's office itself: whether a Commissioner has been appointed and is actively exercising the functions set out in the Act, and whether any registration regime for controllers or processors has been brought into operation, were not confirmed from available sourcing. The Act's substantive framework — its establishment of a dedicated regulator with defined extraterritorial reach — is well-confirmed; the practical, day-to-day operation of that framework is the open question carried forward. #### Outlook Subsequent cycles should seek primary-source confirmation of whether the Data Protection Commissioner's office is presently staffed and operational, and whether it has issued any guidance, registration requirements, or enforcement notices since the Act came into force in November 2021. Until that operational confirmation is reached, Belize's data protection framework should be read as a well-established, extraterritorially-reaching statutory structure whose practical enforcement posture has not yet been independently verified. Read full narrative · 372 words No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (4) - [National Assembly of Belize](https://www.nationalassembly.gov.bz/wp-content/uploads/2021/12/Act-No-45-of-2021-Data-Protection-Act.pdf) — Data Protection Commissioner — Data Protection Act, 2021, s.68, as a public officer in the Ministry responsible for digital transformation/e-governance/IT - [Breaking Belize News](https://www.breakingbelizenews.com/2026/08/26/sib-pushes-new-data-law-to-modernize-belizes-statistical-system/) — National Data and Statistical Systems Act, 2026 (draft) — Consultation/drafting; briefed to National Statistical System agencies 25 August 2026; does not supersede the Data Protection Act, 2021 - [Government of Belize Digital Agenda](https://digitalagenda.gov.bz/wp-content/uploads/2023/06/03%20-%20CCA%20-%20Data%20Protection%20Act.pdf) — Data Protection Act, 2021 — Applies to processing by controllers/processors established in Belize, and to non-established controllers/processors offering goods or services to Belize data subjects. - [University of the West Indies](https://www.uwi.edu/data-protection/?q=resources-external-belize) — Office of the Data Protection Commissioner (Belize) — Established under s.68 of the Data Protection Act 2021, with functions under s.69. ### BZ: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ Comprehensive gap — searches returned only structural/institutional provisions, not the substantive processing-conditions text. Primary framework Data Protection Act (Cap. 43:14, Laws of Belize) — substantive processing-conditions text not retrieved Supervisory authority Information and Data Protection Commission Traffic-light rationale — Red Comprehensive gap — searches returned only structural/institutional provisions, not the substantive processing-conditions text. D2 · Lawful Processing — Full Module Record 4 sub-modules · 263 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### BZ: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ One sub-module (rectification) is evidenced directly from bill text; the remaining four sub-modules carry no sourced findings. Primary framework Data Protection Act (Cap. 43:14) / Data Protection Bill, 2024 (draft s.43 — rectification) Supervisory authority Information and Data Protection Commission Traffic-light rationale — Amber One sub-module (rectification) is evidenced directly from bill text; the remaining four sub-modules carry no sourced findings. #### Sub-modules (5) #### Access RightRed Not located. Claims (1): - Data Protection Act, 2021 — Access, including existence of ADM/profiling and meaningful information about its logic #### Rectification And ErasureAmber The 2024 Bill grants a right to rectification of inaccurate data and completion of incomplete data (draft s.43); no erasure/right-to-be-forgotten provision was located in retrieved excerpts. Claims indexed in baseline register · source extraction in progress #### Restriction And ObjectionRed Not located. #### Data PortabilityRed Not located. #### Deadlines And Response WindowsRed Not located. The 2024 reform Bill confirms a rectification right modelled closely on GDPR-style drafting. No sourced text on access, erasure, restriction/objection, portability, or statutory response deadlines was located for Belize. Sources and claims (1) - [Government of Belize Digital Agenda](https://digitalagenda.gov.bz/wp-content/uploads/2023/06/03%20-%20CCA%20-%20Data%20Protection%20Act.pdf) — Data Protection Act, 2021 — Access, including existence of ADM/profiling and meaningful information about its logic ### BZ: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Full-module gap across all seven declared sub-modules; only institutional/Commission-powers text (routed to regulator_and_framework/enforcement_and_redress) was retrievable. Primary framework Data Protection Act (Cap. 43:14, Laws of Belize) — controller/processor obligations text not retrieved Supervisory authority Information and Data Protection Commission Traffic-light rationale — Red Full-module gap across all seven declared sub-modules; only institutional/Commission-powers text (routed to regulator_and_framework/enforcement_and_redress) was retrievable. D4 · Controller & Processor — Full Module Record 7 sub-modules · 285 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### BZ: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Full-module gap; no cross-border transfer regime text retrieved. Supervisory authority Information and Data Protection Commission Traffic-light rationale — Red Full-module gap; no cross-border transfer regime text retrieved. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 293 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### BZ: D6 Sectoral Watch8 sub-modulesRedEnacted in forceModule confidence: Probable▾ Full-module gap across all eight declared sub-modules. Traffic-light rationale — Red Full-module gap across all eight declared sub-modules. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 27 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### BZ: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ Full-module gap across all six declared sub-modules. Traffic-light rationale — Not assessed Full-module gap across all six declared sub-modules. #### Sub-modules (6) #### Cookies And TrackersRed Not located. #### Dark PatternsRed Not located. #### Opt Out SignalsRed Not located. #### Clean Rooms And DcrRed Not located. #### Cross Context AdvertisingRed Not located. #### Direct MarketingRed Not located. No sourced cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression provision specific to Belize was located. ### BZ: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Full-module gap across all six declared sub-modules. Traffic-light rationale — Red Full-module gap across all six declared sub-modules. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 217 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### BZ: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ Full-module gap across all five declared sub-modules. Traffic-light rationale — Not assessed Full-module gap across all five declared sub-modules. #### Sub-modules (5) #### Age VerificationRed Not located. #### Parental ConsentRed Not located. #### Minor Profiling BansRed Not located. #### Education SettingsRed Not located. #### Dependent AdultsRed Not located. No sourced age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection specific to Belize's data protection regime was located. ### BZ: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Investigatory powers are evidenced directly from bill text; penalty quantum, appeal routes, redress mechanisms, and an enforcement track record are unconfirmed gaps. Primary framework Data Protection Act (Cap. 43:14) / Data Protection Bill, 2024 Supervisory authority Information and Data Protection Commission Traffic-light rationale — Amber Investigatory powers are evidenced directly from bill text; penalty quantum, appeal routes, redress mechanisms, and an enforcement track record are unconfirmed gaps. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 285 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties