Jamaica's Data Protection Act, what MSMEs must do now

Jamaica's Data Protection Act, 2020 applies to organisations of every size, not just large corporations. If your business collects names, phone numbers, addresses, payment details or any other information about identifiable people, customers, employees, suppliers or members, you are processing personal data and the Act applies to you.

The good news is that becoming compliant is a series of manageable steps, not a single overwhelming project. Here is a sensible order to work through.

Understand what personal data you hold

Most businesses are surprised by how much personal data they hold once they look. Start by mapping the categories of people whose data you process and the systems where that data lives. A Personal Data Register turns this into a living record you can maintain over time rather than a one-off spreadsheet.

Tell people how you use their data

A clear, accurate privacy notice is the most visible sign that a business takes data protection seriously. It should explain what you collect, why, who you share it with, how long you keep it and how people can exercise their rights.

Be ready to handle rights requests

Individuals have rights over their own data, including the right to access it. A request can arrive by email, phone or in person, and the Act sets time limits for responding. Having a simple, repeatable process in place before the first request arrives saves a great deal of stress.

Prepare for the worst

Even careful organisations experience incidents. Knowing in advance how you would assess a suspected breach, who you would tell and within what timeframe means you can respond calmly rather than scrambling.

Legal note. This article is general information about the Data Protection Act, 2020, not legal advice. For advice on your specific circumstances, consult a qualified professional.

The Jamaica Privacy Hub free Compliance Health Check is a five-minute way to see where you stand and what to prioritise first.