Data Protection Act compliance in Jamaica

What the JDPA requires

The Act is overseen by the Office of the Information Commissioner (OIC). It applies to data controllers, the organizations that decide how and why personal data about customers, members, patients, students or employees is processed. Data controllers must follow eight data protection standards:

• Fairness and lawfulness: have a lawful basis for processing.
• Purpose limitation: use data only for the purposes it was collected for.
• Data minimization: collect only what you need.
• Accuracy: keep personal data accurate and up to date.
• Storage limitation: do not keep it longer than necessary.
• Rights of data subjects: respect rights such as access to their own data.
• Technical and organizational measures: protect data against unauthorized processing, loss or damage.
• Cross-border transfers: send personal data outside Jamaica only where the destination ensures adequate protection, subject to exceptions in the Act.

Breach reporting, registration and DPOs

A data controller must report to the Information Commissioner any security breach that affects or may affect personal data, and any contravention of the standards, within 72 hours of becoming aware of it. The report must describe what happened, who and what data is affected, and the steps taken in response. Affected individuals must also be notified in the form and time set by regulations.

Data controllers must register with the OIC. Registration opened on December 1, 2023 and has been phased in, with public authorities, financial, educational and health institutions, security service providers and large-scale processors asked to register first. Check the OIC website for the current position for your organization.

A Data Protection Officer (DPO) is required for public authorities, organizations that process sensitive personal data or criminal conviction data, large-scale processors, and any class the Commissioner prescribes. The DPO must be free of conflicts of interest, and the OIC must be given their contact details.

The Act creates criminal offenses. Breaching the standards or failing to make a required report can lead to fines and, for individuals, imprisonment, and a company convicted of an offense can be fined up to four percent of its annual gross worldwide turnover for the preceding year.

How we support Data Protection Act compliance in Jamaica

Our team pairs governance experience, including ISACA credentials and the COBIT framework, with hands-on security work, so our policies match the systems you run. Our JDPA compliance checklist is a useful place to start.

• Mapping what personal data you hold, where it lives, who can access it and where it is sent.
• A gap assessment against the eight standards, with a prioritized action plan.
• Privacy notices, policies, retention schedules and data subject request procedures.
• A breach response procedure built around the 72-hour requirement, tested in a tabletop exercise.
• Security controls, from access control to managed security monitoring.
• Staff training on handling personal data and recognizing a breach.