Jamaica's Data Protection Act, 2020 (JDPA) sets rules for how organizations collect, use, store, share and dispose of personal information about people. It applies to paper files as well as electronic records, and to small businesses as well as large ones. This checklist turns the Act's main obligations into practical steps you can work through with your team.
Where the Act stands in 2026
The Act was signed into law in July 2020. The provisions that set up the Office of the Information Commissioner came into operation on December 1, 2021, and the main obligations on businesses took effect on December 1, 2023. The OIC then gave data controllers a six-month grace period to register. From June 1, 2024, it prioritized registration for government bodies, controllers in high-risk sectors such as financial services, health, education, tourism and ICT, controllers required to appoint a data protection officer, and controllers processing data about more than 10,000 people.
Enforcement capacity is still being built. In July 2026, the Jamaica Gleaner reported that the Information Commissioner told Parliament's Public Accounts Committee the office would not be in a position to fully enforce the law until 2028, and that registration had been suspended since December 1, 2025, with plans to resume toward the end of September 2026. The same report noted that organizations handling personal data must still comply with the law in the meantime. The duties are already in force; it is the regulator's enforcement machinery that is catching up.
The checklist
1. Confirm that the Act applies to you
If your organization decides why and how personal data is processed, you are a data controller. Personal data is any information from which a living person, or a person who died less than 30 years ago, can be identified: names, addresses, phone numbers, ID numbers, photos, CCTV footage, staff files and customer records. Sensitive personal data includes health information, genetic and biometric data, racial or ethnic origin, religious or political beliefs, and information about criminal allegations or proceedings. If you keep a customer list or employ staff, the Act almost certainly applies to you.
2. Map the personal data you hold
You cannot protect, register or report on data you have not found. Build a simple inventory that answers these questions for each type of record:
- What personal data do we collect, and about whom (customers, staff, applicants, suppliers, visitors)?
- Where is it kept: which systems, cloud services, shared drives, phones, email inboxes and paper files?
- Why do we collect it, and do we actually need all of it?
- Who inside the business can access it?
- Who do we share it with, including vendors and anyone outside Jamaica?
- How long do we keep it, and how do we dispose of it?
3. Register with the Information Commissioner
Data controllers must register with the OIC and pay a prescribed fee, then an annual fee to keep the registration current. Registration is done online. The registration particulars include your name and contact details, whether you are a public authority, your representative and data protection officer, a description of the personal data you process, the categories of people it relates to, your purposes, who you disclose it to, and the countries you transfer it to. Your data map from step 2 gives you most of these answers. Because registration was paused in late 2025, check the OIC's current position before you apply.
4. Decide whether you need a data protection officer
According to OIC guidance, a controller must appoint a data protection officer (DPO) if it:
- is a public authority;
- processes, or intends to process, sensitive personal data or data relating to criminal convictions;
- processes personal data on a large scale; or
- is required to by a notice from the Commissioner.
A DPO monitors compliance with the Act and the data protection standards, consults the Commissioner when the rules are unclear, reports contraventions that are not fixed within a reasonable time, and helps people exercise their rights. Even if you do not need a formal DPO, name one person who is accountable for data protection in your business.
5. Check your processing against the eight standards
The Act sets out eight data protection standards. Review each one against your data map:
- Process personal data fairly and lawfully.
- Collect it only for specific, lawful purposes and do not use it for unrelated ones.
- Keep it adequate, relevant and limited to what is necessary.
- Keep it accurate and up to date.
- Do not keep it longer than necessary, and dispose of it properly.
- Process it in line with the rights of the people it is about.
- Protect it with appropriate technical and organizational measures.
- Only transfer it outside Jamaica to places that ensure an adequate level of protection.
6. Update privacy notices and consent
Tell people, in plain language, what you collect, why, who you share it with, how long you keep it and how they can exercise their rights. Put this on your website, forms, job applications and CCTV signage. Where you rely on consent, make it clear and specific, and record it. People also have the right to object to their data being used for direct marketing.
7. Set up a process for data subject requests
Individuals can ask for a copy of their data, ask you to correct it, ask you to stop processing it in certain situations, and ask that significant decisions about them are not made solely by automated means. OIC guidance says controllers must respond to access requests within 30 days and to requests to stop processing within 21 days. Decide who receives requests, how you verify identity, and how you log each request and your response.
8. Put appropriate security measures in place
The seventh standard requires technical and organizational security. For most businesses, that means at least:
- Multi-factor authentication on email, cloud services and remote access.
- Access limited to the staff who need it, with separate admin accounts.
- Encryption on laptops and phones that hold personal data.
- Regular patching, and replacement of unsupported systems.
- Backups kept offline or off-site, and tested by actually restoring them.
- A properly configured firewall and logging that would let you investigate an incident.
- Locked storage for paper files, and secure shredding or wiping when records are disposed of.
9. Review contracts with processors and vendors
Payroll providers, cloud services, IT support firms, marketing agencies and background screening companies may all process personal data on your behalf. Make sure each has a written agreement that requires them to protect the data and use it only on your instructions, and that you know where they store it.
10. Check cross-border transfers
Cloud email, file storage and software hosted overseas all involve transferring personal data out of Jamaica. Transfers are allowed to places that ensure adequate protection, and in certain other circumstances set out in the Act, such as with the person's consent or where the transfer is needed to perform a contract with them. Document which transfers you make and the basis for each.
11. Set retention periods and dispose of data securely
Decide how long each type of record is kept, taking account of other legal requirements such as tax and employment records, then delete or destroy it when that period ends. Old CVs, former customers' ID copies and years of CCTV footage are common problem areas.
12. Prepare a breach response plan
Controllers must report a security breach that affects or may affect personal data to the Information Commissioner within 72 hours of becoming aware of it. As an attorney at Myers, Fletcher & Gordon explained in the Jamaica Observer in March 2026, the 72 hours are not for working out whether personal data was actually affected; the duty arises once a breach has the potential to affect it. The report should cover the facts of the breach, the categories and number of people and records involved, the measures taken or proposed, the likely consequences, and your DPO's contact details.
You must also notify the people affected promptly, explaining the nature of the breach, what you are doing about it and how to contact your DPO. Keep a record of every breach and the remedial action taken. Write all of this into a short plan, with named people and phone numbers, before you need it.
13. Prepare your annual data protection impact assessment
OIC guidance states that a data controller must submit a data protection impact assessment (DPIA) to the Commissioner within 90 days after the end of each calendar year, covering all personal data in its custody or control. A DPIA describes the processing and its purposes, assesses whether it is necessary and proportionate, identifies the risks to individuals, and sets out the safeguards in place. Keep your data map and security records current and the DPIA becomes much easier to produce.
14. Train your staff
Most breaches start with a person: a phishing email, a misdirected attachment, a lost phone. Train staff on what personal data is, how to handle it, how to spot phishing, and how to report a suspected breach quickly so the 72-hour clock can be met.
What happens if you don't comply
Under the Act, the Commissioner can investigate complaints and issue enforcement, information and assessment notices. Where a company commits an offense under the Act, it can be fined up to 4% of its annual gross worldwide turnover for the preceding year. Individuals can face fines and, for some offenses, imprisonment of up to ten years. People who suffer damage because of a contravention can also claim compensation from the data controller.
Where to start if you have done nothing yet
Do not try to fix everything at once. Name an accountable person, build your data map, turn on multi-factor authentication and confirm your backups work, check your registration status with the OIC, and write a one-page breach plan. Those five steps cover the highest risks and make every later step easier.
If you would like help working through this list, our Data Protection Act compliance service covers data mapping, policies, security controls, breach planning and staff training for Jamaican organizations. You can also request an assessment to get a prioritized view of your gaps.