Jamaica

Section 3(1) of the Data Protection Act, 2020 applies the Act to a data controller that is established in Jamaica, or that although not established in Jamaica either uses equipment in Jamaica other than for transit, or processes the data of a person who is in Jamaica where the activity relates to offering products or services to people in Jamaica (payment or not) or to monitoring behaviour that takes place in Jamaica. Section 3(2) then says a controller in that second category 'shall appoint for the purposes of this Act a representative established in Jamaica'. Section 3(3) defines establishment to include a Jamaican company, a Jamaican partnership, an ordinarily resident individual, and any person maintaining an office, branch, agency or regular practice in Jamaica. There is no threshold provision anywhere in the Act.

The eighth data protection standard, in section 31 of the Data Protection Act, 2020, is a self-assessed adequacy test copied in shape from older Commonwealth privacy laws. Adequacy is judged 'in all the circumstances of the case' against eight listed factors: the nature of the data, the country of origin, the country of final destination, the purposes and period of processing, the law in force in that country, its international obligations, any enforceable codes of conduct, and the security measures applied there. Section 31(4) then lists ten situations in which the standard does not apply at all, including the person's consent, necessity for a contract, substantial public interest, legal proceedings or legal advice, vital interests, transfers from a public register, terms approved by the Commissioner, transfers authorised by the Commissioner, and national security or crime prevention. Section 31(5)(c) lets the Minister publish an order naming countries deemed adequate; we found no such order as at 19 August 2026, and section 31(6) restricts any such order to what is needed to fulfil Jamaica's international obligations. Section 31(7) lets the Commissioner rule on a specific destination and issue a notice stating the determination. Sector check, run on 19 August 2026 across banking, payments, insurance, securities, pensions, health, telecoms, government cloud, education, gambling, mapping and defence: no localisation or mirroring requirement was found in any of them. The strongest sector overrides are supervisory, not geographic. The Bank of Jamaica's draft outsourcing standard would require that an offshore arrangement 'does not impair the ability of the licensee or the Supervisor to access, supervise, review, reconstruct' the information, and that records be producible in English on request; that draft is still out for consultation. The Financial Services Commission requires a 72-hour incident report. Government bodies must get the Attorney General's Office to approve the terms of service of any overseas cloud service. Registration particulars under section 16(2)(g) require every controller to name the countries it sends data to, so the state can see the flows even though it does not block them.

Model: case-by-case self-assessment against a statutory adequacy test, with a broad set of statutory exceptions. There is no allowlist in force (the Minister's power under section 31(5)(c) has not been exercised as far as we could find) and no blocklist power at all. Two routes give you certainty if you want it: section 31(4)(h) covers a transfer 'made on terms (which may include contractual terms) that are of a kind approved by the Commissioner', and section 31(4)(i) covers a transfer 'authorised by the Commissioner'. We found no approved terms and no published authorisations, so both routes are theoretical today. Section 31(7) lets you ask the Commissioner to determine a destination's adequacy and obliges the Commissioner to issue a notice naming the relevant foreign supervisory authority and stating the determination. Practical consequence: the paperwork that matters is internal. Keep a written transfer assessment against the eight statutory factors, make sure your supplier contract carries the security duty in the seventh standard, and remember that section 16(2)(g) requires the destination countries to appear in your registration particulars, so the assessment and the register entry must agree.

Evidence of the rating, all from Jamaican government sources checked on 19 August 2026. (1) Minister without Portfolio Dr Andrew Wheatley, contributing to the 2026/27 Sectoral Debate on 2 June 2026: 'We have the law. What we have not yet done is fully enforce it.' He described the office as having 'functional areas unprovided for, staffing below the required level, and key officers without the specialised technical training that compliance oversight demands', and said enforcement provisions will be activated only once restructuring is complete. (2) The Data Protection Oversight Committee has still not been constituted. The Minister blamed the statutory requirement for a retired High Court judge and said the point 'warrants legislative review'; the Commissioner's own oversight committee page lists no members. (3) The Commissioner's Reports page returns 'No available content' — no annual report, no casework statistics, no enforcement decisions. (4) On 15 March 2026 the office told the public the registration portal was offline and that 'no liability under the Act will be imposed by the Commissioner on data controllers for processing personal data without registration during the period the platform is offline.' (5) Signs of movement, not enforcement: a Data Protection Working Group was constituted on 17 March 2026 after a public call in October 2025, and the office's full budget request for 2026/27 was approved. Note also section 72(3) of the Act: a public authority cannot be prosecuted at all, so roughly the largest holder of Jamaican personal data sits outside the penalty regime. Actual sanctions under the Act run through the criminal courts — the Parish Court and the Circuit Court — not through administrative fines by the Commissioner.

Ceiling. The fifth data protection standard, in section 28 of the Act, says personal data must not be kept longer than necessary. The Data Protection (Disposal of Personal Data) Regulations, 2024 put flesh on it: a controller must regularly review all the personal data it holds, dispose of anything no longer needed, and 'develop policies, and implement procedures consistent with those policies, governing the retention and disposal of data and specifying the minimum and maximum periods for which personal data shall be kept before being disposed of'. Disposal must make the data incapable of further processing and incapable of identifying or being linked to the person, and must be permanent 'having regard to all reasonably foreseeable technological developments'. Those Regulations were made on 4 March 2024, affirmed by the Senate on 19 July 2024 and by the House on 17 June 2025, and published in the Jamaica Gazette Supplement on 17 September 2025. Floor. The Regulations themselves carve out data that must be kept under other law, under the Act's own record-keeping provisions, for a legal claim, or for a legitimate business purpose judged against sector standards. The clearest published floor is anti-money-laundering: the Bank of Jamaica's Guidance Notes, gazetted 17 June 2026, require regulated financial institutions to 'make and retain for a period of not less than seven years or such other period specified in writing by the supervisory authority a record of all complex, unusual or large business transactions'. A second, smaller clock: a controller must keep any personal data used to make a decision about a person long enough for that person to be able to ask for access to it. A third: an entry in the public register of data controllers lapses after twelve months unless the annual fee is paid. Conflict rule. The Disposal Regulations resolve it in favour of retention — the duty to dispose applies only to data that is no longer required for any of the listed reasons, one of which is retention required by law.

Clock one. Section 21(3) of the Act: the controller must report to the Commissioner any contravention of a data protection standard and any security breach affecting personal data 'within seventy-two hours after becoming aware'. Note the width — it is not limited to breaches, it covers any contravention of any of the eight standards. Regulation 10 of the Data Protection Regulations, 2024 prescribes Form 7 and requires further information to be reported as it emerges. Failing to report is an offence under section 21(2), punishable on summary conviction by a fine of up to two million Jamaican dollars (roughly twelve thousand United States dollars) or two years' imprisonment, or on indictment by an unlimited fine or seven years. Clock two. Regulation 10(4): notification to each affected individual 'shall be made within seventy-two hours after the data controller becomes aware'. This is the clock people miss, because in most comparable regimes notifying individuals is a 'without undue delay' duty and can be deferred. Section 21(4) sets out what the report must contain, including the categories and numbers of people and records affected and the contact details of your data protection officer. Clock three. The Bank of Jamaica's Standard of Sound Practice on the Management of Cyber Risks requires deposit-taking institutions to report incidents 'promptly to the Bank of Jamaica and appropriate authorities within 72 hours', and to inform their board within 72 hours. Clock four. The Financial Services Commission's Industry Guidance on the Management of Cyber Risks, effective 1 October 2025 for insurance, pensions and securities licensees: 'FIs must report cyber incidents and data breaches promptly to the Financial Services Commission within 72 hours', and the guidance names the Bank of Jamaica, the Jamaica Cyber Incident Response Team, the Office of the Information Commissioner, the Major Organised Crime and Anti-Corruption Agency, the Financial Investigations Division and the Jamaica Constabulary Force as other bodies that may need telling. Clock five, informal. The Government of Jamaica's own compliance framework tells public bodies to report to the Commissioner within 72 hours and to alert the Jamaica Cyber Incident Response Team and the police for cyber incidents.

1. Criminal, not administrative. There is no power for the Commissioner to issue a fine. Contraventions go to the Parish Court or the Circuit Court. Processing in breach of a standard, or failing to report a breach, carries up to two million Jamaican dollars or two years on summary conviction, or an unlimited fine and seven years on indictment. On top of that, section 68(1) says that where a body corporate commits any offence under the Act it 'shall be liable to a fine not exceeding four percent of the annual gross worldwide turnover of that body corporate for the preceding year of assessment'. Directors and officers can be personally liable where the offence was committed with their consent or connivance. 2. Public authorities are immune from prosecution. Section 72(3): 'A public authority shall not be liable to prosecution under this Act.' The Act binds the Crown but the sanction does not reach it. If your risk analysis assumes government bodies face the same exposure as you, it is wrong. 3. The seventy-two hour clock to individuals. See question six. It is in regulation 10(4), not in the Act, so a reader of the statute alone will miss it. 4. People in Jamaica. Two separate requirements. A controller with no establishment in Jamaica must appoint a representative established in Jamaica. Separately, regulation 9(2) says that where the data protection officer resides outside Jamaica, the controller must ensure that officer 'has a representative who resides in Jamaica' and is tasked with making sure the officer's functions are carried out. So an offshore group privacy officer is not enough on its own. 5. Subject access is not free and not automatic. A person has thirty days to get their data, but the Minister's Regulations set fees, and regulation 5(4) says the controller 'is not obliged to provide information requested under section 6(2) of the Act until the applicable fees have been paid'. Public bodies may only waive the fee on hardship grounds. 6. A dormant pre-clearance regime. Section 19 lets the Minister designate categories of 'specified processing' that are particularly likely to cause substantial damage or distress. Once designated, you may not start that processing until you have filed registration particulars and either thirty days have passed or the Commissioner has issued an assessment notice. Doing it anyway is punishable by five million Jamaican dollars or five years, or ten years on indictment. No such order has been made, so the whole scheme sits idle — and can be switched on by a Gazette notice. 7. Children are anyone under eighteen, and rights are exercised by a parent or guardian with documentary proof of identity and relationship. 8. Who needs a data protection officer is broader than it looks: every public authority, anyone processing sensitive personal data or criminal conviction data, anyone processing personal data 'on a large scale', and any class the Commissioner names by Gazette notice.

Dated items in the next twelve months. • 30 October 2026 — the Bank of Jamaica's consultation on Standards for Outsourcing Arrangements and Third-Party Risk Management closes. It would apply to every deposit-taking institution and financial holding company, require country risk assessments for offshore arrangements, require that records be producible in English on request, and require 'timely and unrestricted' supervisory access to books, records, systems, data and personnel. It is a draft and has no legal effect yet. • November 2026 — the National Artificial Intelligence Task Force is to deliver a draft National AI Policy covering eight domains including ethics and legal frameworks, announced by the Minister on 2 June 2026. • From 1 December 2026 — section 77 of the Act requires the Act to be reviewed every five years from the first appointed day, which was 1 December 2021. The Minister has already flagged one target for that review: the requirement that the Data Protection Oversight Committee include a retired High Court judge, which he described as a bottleneck warranting legislative review. • No date — the reopening of the data controller registration portal. The regulator says the public will be told through its official channels. • Under consideration, no date — a 'data embassy', announced on 22 June 2026 as something the government is 'seriously going to start looking at', to store sovereign Jamaican data in another jurisdiction under embassy-like protection. Note the direction of travel: that is the opposite of localisation. Dormant switches — powers the government already holds that could change the picture without consultation. • Section 31(5) — the Minister may by Gazette order name the countries deemed to have adequate protection, and may prescribe what counts as substantial public interest. Never used. • Section 19 with section 74(3)(c) — the Minister may designate categories of 'specified processing' requiring a thirty-day standstill and a Commissioner assessment before processing may begin. Never used. • Section 15(2) — the Minister may exempt whole classes of processing or of controllers from the registration requirement. Used only to the extent of the classes already in the Act. • Section 20(6)(d) — the Commissioner may by Gazette notice name classes of controller that must appoint a data protection officer. • Section 33 — the Minister responsible for national security may certify personal data as exempt from provisions of the Act. • The Commissioner's March 2026 forbearance on registration is an advisory, not a legal amnesty. It can be withdrawn on the day the portal comes back, and the underlying offence in section 18 never stopped existing. • Political direction: the Minister told Parliament on 2 June 2026 that 'data sovereignty — Jamaica's right to control, govern, and benefit from the data generated within our borders — is not a technical concept. It is a national security and national development imperative.' There is no localisation rule today, but that is the language that usually precedes one.