Jurisdiction · The Bahamas

Data sovereignty in The Bahamas

"Data sovereignty" gets used to mean three different things at once: where the data is, which law governs it, and who can be compelled to hand it over. They are separable, and a setup can satisfy one while failing the others.

Three things that are not the same

The common failure is buying residency and assuming sovereignty came with it. A server in Nassau operated by a company reachable by a foreign court gives you the first and not the third. Residency is a property of the disk; sovereignty is a property of the arrangement.

The Bahamian legal framework

The Bahamas has had statutory data protection since 2003, under the Data Protection (Privacy of Personal Information) Act, which established the office of the Data Protection Commissioner and set out obligations familiar to anyone who has worked with European rules: lawful and fair collection, purpose limitation, accuracy, security safeguards, and retention only for as long as necessary.

That framework has been modernised. A new Data Protection Act, 2025 received assent on 9 December 2025 and repeals the 2003 Act. It brings in a dedicated part governing transfers of personal data outside The Bahamas, alongside broader controller obligations. Its provisions commence on dates appointed by the Minister and published in the Gazette, so the transition runs in stages.

The practical consequence for a business choosing where to store records: The Bahamas is not an unregulated jurisdiction. It is a regulated one, with its own statute, its own regulator and its own courts — outside both US and EU jurisdiction, which is a different proposition from being outside the law.

What residency actually requires, technically

Storing the file in-country is the easy part. The details that determine whether the arrangement holds up:

• Where the IP space is domiciled. Bahamian-registered address space announced locally means the service is reachable without depending on foreign address blocks.
• How traffic routes. If every packet transits Miami by default, "the data never leaves the country" is doing a lot of work.
• Who owns the building. A tenant in someone else's facility inherits that landlord's terms, and their continuity risk.
• Carrier neutrality. A single upstream is a single point of both failure and leverage.
• Where backups go. Replication to a foreign region quietly undoes the whole arrangement.

How Secure Shore is set up

Secure Shore has operated its own facility in Nassau since 2015 — the only purpose-built, privately owned, carrier-neutral data center in The Bahamas. Not a rented cage, not a reseller arrangement.

Services are announced from Bahamian-domiciled IP addresses, BGP-bonded across four independent local carriers, so connectivity does not depend on any single upstream and traffic has no structural need to transit the United States. Data is encrypted with AES-256 at rest and TLS in transit, and residency is 100% in The Bahamas — including backups.

The facility sits 180 miles from Miami, which is close enough for workable latency to North America and far enough to be a genuinely separate jurisdiction and a separate risk zone. More on that in disaster recovery for the Caribbean.