Not publishable as-is. 2 of 7 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.
BZ Data Protection & Privacy Regulation
BZschema gdpri-v2trajectory: not yet assessedregulated (omnibus)
Last updated · 10 categories · 16
claims · 15 sources in the cumulative register
A draft National Data and Statistical Systems Act, 2026 was briefed to Belize's National Statistical System agencies on 25 August 2026, with technical support reported from UNDP and KOICA.
Data collected · Data published
AI-assembled from cited sources
Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
Jurisdiction lead brief
Standing brief, as of 25 October 2026.
Lead Signal
A draft National Data and Statistical Systems Act, 2026 was briefed to Belize's National Statistical System agencies on 25 August 2026, with technical support reported from UNDP and KOICA. The draft Act is intended to govern the production, sharing, protection and use of statistical data across the National Statistical System and remains at the consultation and drafting stage; it does not supersede the existing Data Protection Act, 2021, which continues as Belize's sole comprehensive data-protection instrument. This is a sectoral development rather than a change to the general data-protection regime, and it should be read as a distinct statistical-data governance track running in parallel to, rather than displacing, the omnibus Act.
Other Developments
The drafting process is reported as still active as of late August 2026, with the Statistical Institute of Belize reported as the agency pushing the new law forward to modernise the jurisdiction's statistical system. No finalisation date, enactment date, or further legislative stage beyond the briefing to agencies has been confirmed.
Cross-Monitor Connections
A statistical-data governance framework of this kind can intersect with financial-integrity reporting obligations and with payments-sector data-sharing arrangements tracked elsewhere in this fleet, particularly where statistical data collection touches financial-sector reporting. No specific cross-reference to either of those domains was identified in the material located, and the draft Act's relationship to sector-specific reporting obligations elsewhere in Belize's regulatory architecture remains to be clarified as the drafting process proceeds.
Outlook
The National Data and Statistical Systems Act, 2026 is not expected to reach finalisation in the near term; the material located anticipates further progress only around the second quarter of 2027, and that date carries a wide uncertainty band. Until the draft Act advances beyond consultation and drafting, the Data Protection Act, 2021 remains the only instrument governing personal-data processing generally in Belize, with this sectoral initiative developing alongside it rather than in place of it.
Key regulatory facts for BZ
Regulatory Dimension
BZ Standing Position
Jurisdiction
BZ (BZ)
Regulatory Scope
Data Protection & Privacy Regulation (10 modules, 16 sourced findings)
Regulator & Framework
A comprehensive statute and named regulator are confirmed via secondary/bill sources, but primary-instrument verification (gazette, commencement order, confirmed Bill passage) is outstanding.
Lawful Processing & Special Data
Comprehensive gap — searches returned only structural/institutional provisions, not the substantive processing-conditions text.
Data Subject Rights
One sub-module (rectification) is evidenced directly from bill text; the remaining four sub-modules carry no sourced findings.
Controller/Processor Duties
Full-module gap across all seven declared sub-modules; only institutional/Commission-powers text (routed to regulator_and_framework/enforcement_and_redress) was retrievable.
Primary Instruments Cited
National Assembly of Belize, Breaking Belize News, Government of Belize Digital Agenda, University of the West Indies, DiploFoundation
Last Confirmed / Updated
2026-10-25 (15 sources in cumulative register)
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
A comprehensive statute and named regulator are confirmed via secondary/bill sources, but primary-instrument verification (gazette, commencement order, confirmed Bill passage) is outstanding.
Primary frameworkData Protection Act (Cap. 43:14, Laws of Belize) — subject to proposed repeal and re-enactment under the Data Protection Bill, 2024 (Bill No. 19 of 2024)
Supervisory authorityInformation and Data Protection Commission
Traffic-light rationale — AmberA comprehensive statute and named regulator are confirmed via secondary/bill sources, but primary-instrument verification (gazette, commencement order, confirmed Bill passage) is outstanding.
Sub-modules (5)
Regulator And AuthorityAmber
The Information and Data Protection Commission is constituted as a public office consisting of a Commissioner and such Deputy Commissioners and officers as necessary, and is given information-production, audit, and contravention-notice powers under the 2024 reform Bill.
Claims (4):
Data Protection Act 2021, ss.61-62 — Requires notification of a personal-data breach to the Commissioner and, separately, to the data subject; the exact deadline figure was not confirmed against the primary Act text this cycle (a secondary source cites a 3-day default, unverified here).
Data Protection Commissioner — Data Protection Act, 2021, s.68, as a public officer in the Ministry responsible for digital transformation/e-governance/IT
Office of the Data Protection Commissioner (Belize) — Established under s.68 of the Data Protection Act 2021, with functions under s.69.
Act And InstrumentsAmber
Cap. 43:14 is the current operative instrument; the 2024 Bill would repeal and re-enact it with transitional/savings provisions preserving continuity of decisions, proceedings and administrative structures.
Claims (4):
Office of the Data Protection Commissioner (Belize) — Established under s.68 of the Data Protection Act 2021, with functions under s.69.
National Data and Statistical Systems Act, 2026 (draft) — Consultation/drafting; briefed to National Statistical System agencies 25 August 2026; does not supersede the Data Protection Act, 2021
Material ScopeRed
No sourced text establishing the precise material-scope test (what data/processing is caught) under Cap. 43:14 or the 2024 Bill was located in this pass.
Territorial ScopeRed
No sourced text establishing an extraterritorial/targeting-and-monitoring test analogous to GDPR Art 3(2) was located for Belize.
Claims (1):
Data Protection Act, 2021 — Applies to processing by controllers/processors established in Belize, and to non-established controllers/processors offering goods or services to Belize data subjects.
Regulator Registration And FilingRed
No sourced provision on controller registration, notification, or fee obligations to the Commission was located.
Category narrative372 words
Regulator & Framework
Belize's data protection framework is established by the Data Protection Act, 2021, enacted as Act No. 45 of 2021. The Act was assented to by the Governor-General on 29 November 2021 and gazetted the following day, 30 November 2021, dates confirmed directly from the National Assembly of Belize's own published text. The Act establishes a Data Protection Commissioner under section 68, who is given responsibility for the Act's general administration, positioning the Commissioner as the central regulatory authority for data protection matters in Belize, with the Commissioner's office housed within the Ministry responsible for digital transformation and e-governance.
The Act's territorial scope extends beyond entities physically established in Belize. Under section 3, it applies to controllers and processors established in Belize in the ordinary course, but it also reaches extraterritorially to processing of Belize data subjects' personal data undertaken by non-established controllers or processors who offer goods or services to those data subjects, a formulation confirmed from a primary Government of Belize source and structurally comparable to the extraterritorial reach found in the EU General Data Protection Regulation and comparable Caribbean and Latin American omnibus statutes. This means an entity with no physical or corporate presence in Belize can nonetheless fall within the Act's scope purely by virtue of offering goods or services to persons located in Belize.
What remains unconfirmed this cycle is the operational status of the Commissioner's office itself: whether a Commissioner has been appointed and is actively exercising the functions set out in the Act, and whether any registration regime for controllers or processors has been brought into operation, were not confirmed from available sourcing. The Act's substantive framework — its establishment of a dedicated regulator with defined extraterritorial reach — is well-confirmed; the practical, day-to-day operation of that framework is the open question carried forward.
Outlook
Subsequent cycles should seek primary-source confirmation of whether the Data Protection Commissioner's office is presently staffed and operational, and whether it has issued any guidance, registration requirements, or enforcement notices since the Act came into force in November 2021. Until that operational confirmation is reached, Belize's data protection framework should be read as a well-established, extraterritorially-reaching statutory structure whose practical enforcement posture has not yet been independently verified.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
Sources and claims (4)
ProbableNational Assembly of Belize — Data Protection Commissioner — Data Protection Act, 2021, s.68, as a public officer in the Ministry responsible for digital transformation/e-governance/ITobserved
ProbableBreaking Belize News — National Data and Statistical Systems Act, 2026 (draft) — Consultation/drafting; briefed to National Statistical System agencies 25 August 2026; does not supersede the Data Protection Act, 2021observed
ProbableGovernment of Belize Digital Agenda — Data Protection Act, 2021 — Applies to processing by controllers/processors established in Belize, and to non-established controllers/processors offering goods or services to Belize data subjects.observed
ProbableUniversity of the West Indies — Office of the Data Protection Commissioner (Belize) — Established under s.68 of the Data Protection Act 2021, with functions under s.69.observed
Comprehensive gap — searches returned only structural/institutional provisions, not the substantive processing-conditions text.
Primary frameworkData Protection Act (Cap. 43:14, Laws of Belize) — substantive processing-conditions text not retrieved
Supervisory authorityInformation and Data Protection Commission
Traffic-light rationale — RedComprehensive gap — searches returned only structural/institutional provisions, not the substantive processing-conditions text.
D2 · Lawful Processing — Full Module Record4 sub-modules · 263 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Supervisory authorityInformation and Data Protection Commission
Traffic-light rationale — AmberOne sub-module (rectification) is evidenced directly from bill text; the remaining four sub-modules carry no sourced findings.
Sub-modules (5)
Access RightRed
Not located.
Claims (1):
Data Protection Act, 2021 — Access, including existence of ADM/profiling and meaningful information about its logic
Rectification And ErasureAmber
The 2024 Bill grants a right to rectification of inaccurate data and completion of incomplete data (draft s.43); no erasure/right-to-be-forgotten provision was located in retrieved excerpts.
Claims indexed in baseline register · source extraction in progress
Restriction And ObjectionRed
Not located.
Data PortabilityRed
Not located.
Deadlines And Response WindowsRed
Not located.
Category narrative29 words
The 2024 reform Bill confirms a rectification right modelled closely on GDPR-style drafting. No sourced text on access, erasure, restriction/objection, portability, or statutory response deadlines was located for Belize.
Sources and claims (1)
ProbableGovernment of Belize Digital Agenda — Data Protection Act, 2021 — Access, including existence of ADM/profiling and meaningful information about its logicobserved
Full-module gap across all seven declared sub-modules; only institutional/Commission-powers text (routed to regulator_and_framework/enforcement_and_redress) was retrievable.
Primary frameworkData Protection Act (Cap. 43:14, Laws of Belize) — controller/processor obligations text not retrieved
Supervisory authorityInformation and Data Protection Commission
Traffic-light rationale — RedFull-module gap across all seven declared sub-modules; only institutional/Commission-powers text (routed to regulator_and_framework/enforcement_and_redress) was retrievable.
D4 · Controller & Processor — Full Module Record7 sub-modules · 285 words · 4 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Full-module gap; no cross-border transfer regime text retrieved.
Supervisory authorityInformation and Data Protection Commission
Traffic-light rationale — RedFull-module gap; no cross-border transfer regime text retrieved.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 293 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Full-module gap across all eight declared sub-modules.
Traffic-light rationale — RedFull-module gap across all eight declared sub-modules.
D6 · Sectoral Watch — Full Module Record8 sub-modules · 27 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Full-module gap across all six declared sub-modules.
Traffic-light rationale — Not assessedFull-module gap across all six declared sub-modules.
Sub-modules (6)
Cookies And TrackersRed
Not located.
Dark PatternsRed
Not located.
Opt Out SignalsRed
Not located.
Clean Rooms And DcrRed
Not located.
Cross Context AdvertisingRed
Not located.
Direct MarketingRed
Not located.
Category narrative20 words
No sourced cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression provision specific to Belize was located.
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Full-module gap across all five declared sub-modules.
Traffic-light rationale — Not assessedFull-module gap across all five declared sub-modules.
Sub-modules (5)
Age VerificationRed
Not located.
Parental ConsentRed
Not located.
Minor Profiling BansRed
Not located.
Education SettingsRed
Not located.
Dependent AdultsRed
Not located.
Category narrative20 words
No sourced age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection specific to Belize's data protection regime was located.
Investigatory powers are evidenced directly from bill text; penalty quantum, appeal routes, redress mechanisms, and an enforcement track record are unconfirmed gaps.
Supervisory authorityInformation and Data Protection Commission
Traffic-light rationale — AmberInvestigatory powers are evidenced directly from bill text; penalty quantum, appeal routes, redress mechanisms, and an enforcement track record are unconfirmed gaps.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 285 words · 3 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 16 claim(s) (16 category placement(s)), 15 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 3 Nov 2026: not upheld (5 confirmed against the cited source; 1 contradicted by the cited source; 8 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.
BZ