Jamaica

Section 3(1) of the Data Protection Act, 2020 covers you if your company is based in Jamaica. It also covers you if you are not based in Jamaica but do one of two things. First, you use equipment in Jamaica for something other than just passing data through. Second, you handle data about someone who is in Jamaica. That applies if you offer them products or services, paid or free. It also applies if you watch what they do in Jamaica. Section 3(2) says that in the second case you must appoint a representative based in Jamaica. Section 3(3) says you count as based in Jamaica if you are a Jamaican company, a Jamaican partnership, or someone who normally lives there. You also count if you keep an office, branch, agency or regular practice in Jamaica. The Act sets no size or revenue threshold anywhere.

The rule is the eighth data protection standard, in section 31 of the Data Protection Act, 2020. You judge for yourself whether the destination protects data well enough. Older Commonwealth privacy laws use the same test. You must weigh eight things, looking at all the circumstances of the case. The type of data. Where it came from. Where it finally ends up. Why it is being used, and for how long. The law in force in that country. That country's international duties. Any binding codes of conduct. And the security measures used there. Section 31(4) lists ten situations where the test does not apply at all. They include the person's consent, a need to perform a contract, and substantial public interest. Also legal proceedings or legal advice, vital interests, and data taken from a public register. Also terms approved by the Commissioner, a transfer the Commissioner has authorised, and national security or crime prevention. Section 31(5)(c) lets the Minister publish an order naming countries treated as safe enough. We found no such order as at 19 August 2026. Section 31(6) limits any such order to what Jamaica needs to meet its international duties. Section 31(7) lets the Commissioner decide on a specific destination and issue a notice saying so. We checked twelve sectors on 19 August 2026: banking, payments, insurance, securities, pensions, health, telecoms, government cloud, education, gambling, mapping and defence. None of them requires data to stay in Jamaica or to be copied there. The strongest sector rules are about supervision, not location. The Bank of Jamaica's draft outsourcing standard would require that an offshore arrangement 'does not impair the ability of the licensee or the Supervisor to access, supervise, review, reconstruct' the information. It would also require records to be produced in English on request. That draft is still out for consultation. The Financial Services Commission requires a 72-hour incident report. Government bodies must get the Attorney General's Office to approve the terms of service of any overseas cloud service. Section 16(2)(g) makes you name the countries you send data to when you register. So the state can see the flows even though it does not block them.

You judge each destination yourself against the test in the law. There is no government permit. There is no published list of approved countries. The Minister can name safe countries under section 31(5)(c) but has not done so, as far as we could find. There is no power to ban countries at all. Two routes would give you certainty if they were live. Section 31(4)(h) covers a transfer 'made on terms (which may include contractual terms) that are of a kind approved by the Commissioner'. Section 31(4)(i) covers a transfer 'authorised by the Commissioner'. We found no approved terms and no published authorisations, so neither route works today. Section 31(7) lets you ask the Commissioner to decide whether a destination protects data well enough. The Commissioner must then issue a notice naming the relevant foreign regulator and stating the decision. So the paperwork that matters is your own. Keep a written assessment of each destination against the eight factors in the law. Make sure your supplier contract carries the security duty in the seventh standard. Section 16(2)(g) makes you list your destination countries when you register, so your assessment and your register entry must match.

Here is the evidence for that rating. All of it comes from Jamaican government sources checked on 19 August 2026. 1. Minister without Portfolio Dr Andrew Wheatley spoke in Parliament on 2 June 2026. He said: 'We have the law. What we have not yet done is fully enforce it.' He described the office as having 'functional areas unprovided for, staffing below the required level, and key officers without the specialised technical training that compliance oversight demands'. He said the enforcement powers will be switched on only once the restructuring is finished. 2. The Data Protection Oversight Committee has still not been set up. The Minister blamed the legal requirement for a retired High Court judge, and said the point 'warrants legislative review'. The Commissioner's own oversight committee page lists no members. 3. The Commissioner's Reports page returns 'No available content'. There is no annual report, no casework statistics and no enforcement decisions. 4. On 15 March 2026 the office told the public that the registration portal was offline. It promised that it would not hold anyone liable for handling personal data without being registered while the portal is down. 5. There are signs of movement, but not of enforcement. A Data Protection Working Group was set up on 17 March 2026, after a public call in October 2025. The office's full budget request for 2026/27 was approved. Note section 72(3) of the Act as well. A public authority cannot be prosecuted at all. So the largest holder of Jamaican personal data faces no penalty. Real punishment under the Act runs through the criminal courts, the Parish Court and the Circuit Court. The Commissioner cannot issue fines.

How long you may keep data. The fifth data protection standard, in section 28 of the Act, says you must not keep personal data longer than you need it. The Data Protection (Disposal of Personal Data) Regulations, 2024 add the detail. You must regularly review all the personal data you hold. You must get rid of anything you no longer need. You must also 'develop policies, and implement procedures consistent with those policies, governing the retention and disposal of data and specifying the minimum and maximum periods for which personal data shall be kept before being disposed of'. Once you dispose of data it must be unusable, and it must no longer identify the person or be linkable to them. The destruction must be permanent 'having regard to all reasonably foreseeable technological developments'. These rules were made on 4 March 2024. The Senate approved them on 19 July 2024 and the House on 17 June 2025. They were published in the Jamaica Gazette Supplement on 17 September 2025. How long you must keep data. The same rules leave out data you have to keep for other reasons. Those are another law, the Act's own record-keeping duties, a legal claim, or a real business purpose measured against your industry's standards. The clearest published minimum is anti-money-laundering. The Bank of Jamaica's Guidance Notes, gazetted 17 June 2026, require regulated financial institutions to 'make and retain for a period of not less than seven years or such other period specified in writing by the supervisory authority a record of all complex, unusual or large business transactions'. There is a second, smaller clock. Did you use someone's personal data to make a decision about them? Keep it long enough for them to ask to see it. There is a third. Your entry on the public register lapses after twelve months unless you pay the annual fee. Which rule wins. Keeping the data wins. The duty to dispose of data only applies to data you no longer need for any of the listed reasons. One of those reasons is that a law requires you to keep it.

Clock one. Section 21(3) of the Act. You must report to the Commissioner within seventy-two hours of finding out. This covers any security breach affecting personal data. It also covers any breach of any of the eight data protection standards, not just security incidents. Regulation 10 of the Data Protection Regulations, 2024 sets out Form 7, and you must send more information as it emerges. Not reporting is a crime under section 21(2). A magistrate can fine you up to two million Jamaican dollars (roughly twelve thousand United States dollars) or jail you for two years. A higher court can impose an unlimited fine or seven years. Clock two. Regulation 10(4). You must tell each affected person within seventy-two hours of finding out. This one is easy to miss, because it sits in the regulations and not in the Act itself. Section 21(4) lists what your report must contain. That includes the types and numbers of people and records affected, and the contact details of your data protection officer. Clock three. The Bank of Jamaica's Standard of Sound Practice on the Management of Cyber Risks. Deposit-taking institutions must report incidents 'promptly to the Bank of Jamaica and appropriate authorities within 72 hours'. They must also tell their own board within 72 hours. Clock four. The Financial Services Commission's Industry Guidance on the Management of Cyber Risks. It took effect on 1 October 2025 for insurance, pensions and securities licensees. It says 'FIs must report cyber incidents and data breaches promptly to the Financial Services Commission within 72 hours'. It also names other bodies you may need to tell. Those are the Bank of Jamaica, the Jamaica Cyber Incident Response Team and the Office of the Information Commissioner. Also the Major Organised Crime and Anti-Corruption Agency, the Financial Investigations Division and the Jamaica Constabulary Force. Clock five, informal. The Government of Jamaica's own compliance guidance tells public bodies to report to the Commissioner within 72 hours. It also tells them to alert the Jamaica Cyber Incident Response Team and the police for cyber incidents.

1. Crimes, not fines from the regulator. The Commissioner has no power to fine you. Cases go to the Parish Court or the Circuit Court. Using data in breach of a standard carries up to two million Jamaican dollars or two years in a magistrate's court. So does failing to report a breach. In a higher court it carries an unlimited fine and seven years. On top of that, section 68(1) says a company that commits any offence under the Act 'shall be liable to a fine not exceeding four percent of the annual gross worldwide turnover of that body corporate for the preceding year of assessment'. Directors and officers can be personally liable where the offence was committed with their consent or connivance. 2. Public authorities cannot be prosecuted. Section 72(3) says: 'A public authority shall not be liable to prosecution under this Act.' The Act binds the Crown, but the punishment does not reach it. If your risk analysis assumes government bodies face the same exposure as you, it is wrong. 3. The seventy-two hour clock to tell individuals. See question six. It sits in regulation 10(4), not in the Act, so anyone reading only the Act will miss it. 4. You need people in Jamaica. There are two separate requirements. If you have no office or business base in Jamaica, you must appoint a representative based in Jamaica. Separately, regulation 9(2) says that if your data protection officer lives outside Jamaica, that officer must have 'a representative who resides in Jamaica'. That stand-in has to make sure the officer's job gets done. An offshore group privacy officer is not enough on its own. 5. A copy of your own data is not free and not automatic. A person gets their data within thirty days. But the Minister's Regulations set fees, and regulation 5(4) says you are 'not obliged to provide information requested under section 6(2) of the Act until the applicable fees have been paid'. Public bodies may only waive the fee for hardship. 6. A pre-clearance system that is switched off. Section 19 lets the Minister name types of data use that are especially likely to cause serious damage or distress. Once named, you cannot start that work until you have filed your registration details. You must then wait thirty days, or wait for the Commissioner to issue an assessment notice. Doing it anyway carries five million Jamaican dollars or five years, or ten years in a higher court. No such order has been made, so the whole scheme sits idle. It can be switched on by a notice in the Gazette. 7. A child is anyone under eighteen. A parent or guardian exercises the child's rights, and must show proof of who they are and how they are related. 8. More organisations need a data protection officer than you would expect. Every public authority needs one. So does anyone handling sensitive personal data or criminal conviction data. So does anyone handling personal data 'on a large scale'. So does any group the Commissioner names in the Gazette.

Dated items in the next twelve months. • 30 October 2026. The Bank of Jamaica's consultation on Standards for Outsourcing Arrangements and Third-Party Risk Management closes. It would apply to every deposit-taking institution and financial holding company. It would require country risk assessments for offshore arrangements. It would require records to be produced in English on request. It would require 'timely and unrestricted' supervisory access to books, records, systems, data and personnel. It is a draft and has no legal effect yet. • November 2026. The National Artificial Intelligence Task Force is due to deliver a draft National AI Policy. It covers eight areas, including ethics and the law. The Minister announced this on 2 June 2026. • From 1 December 2026. Section 77 of the Act requires a review of the Act every five years from the first appointed day, which was 1 December 2021. The Minister has already flagged one target for that review. The Data Protection Oversight Committee has to include a retired High Court judge. He called that a bottleneck that warrants a change in the law. • No date. The reopening of the registration portal. The regulator says it will tell the public through its official channels. • Under consideration, no date. A 'data embassy', announced on 22 June 2026 as something the government is 'seriously going to start looking at'. It would store sovereign Jamaican data in another country under embassy-like protection. That is the opposite of keeping data at home. Powers the government already holds. Any of these could change the answer without consultation. • Section 31(5). The Minister may publish an order in the Gazette naming countries treated as safe enough. He may also set out what counts as substantial public interest. Never used. • Section 19 with section 74(3)(c). The Minister may name types of data use that need a thirty-day standstill and an assessment by the Commissioner before you can start. Never used. • Section 15(2). The Minister may exempt whole classes of business, or whole classes of data use, from having to register. Used only for the classes already in the Act. • Section 20(6)(d). The Commissioner may name in the Gazette classes of business that must appoint a data protection officer. • Section 33. The Minister responsible for national security may certify personal data as exempt from parts of the Act. • The Commissioner's March 2026 forbearance on registration is an advisory, not a legal amnesty. It can be withdrawn on the day the portal comes back. The underlying offence in section 18 never stopped existing. • Political direction. The Minister told Parliament on 2 June 2026 that 'data sovereignty — Jamaica's right to control, govern, and benefit from the data generated within our borders — is not a technical concept. It is a national security and national development imperative.' There is no rule today requiring data to stay in Jamaica. But that is the language that usually comes before one.