Resources
Data Subject Access Requests
Under Jamaica's Data Protection Act 2020, individuals have the right to ask any organisation what personal data it holds about them — and to exercise six additional rights over how that data is used. These requests are called DSARs.
What is a DSAR?
A Data Subject Access Request is a formal request made by an individual (the data subject) to an organisation that processes their personal data. The request may ask the organisation to do one or more of six things: provide access, correct inaccuracies, erase data, restrict processing, receive data in portable form, or stop processing for specific purposes.
A DSAR can arrive by any channel — email, post, telephone, an online form, or in person. It does not need to use any particular wording or reference the DPA. If someone says “can you tell me what information you hold about me?” that is a DSAR and the 30-day clock starts immediately.
You must respond to every DSAR, even if the request turns out to be unfounded or you hold no data about that person. Silence is not an option.
Obligations under the DPA 2020
Section 6 of the Data Protection Act 2020 sets out data subjects' rights in overview; sections 30–35 give each right its detailed scope. All data controllers registered with the Office of the Information Commissioner (OIC) must comply.
Right of access
A data subject may ask you to confirm whether you hold their personal data and, if so, to provide a copy along with information about how it is used.
Right to rectification
If the data you hold is inaccurate or incomplete, the data subject may require you to correct or complete it without undue delay.
Right to erasure
Also called the "right to be forgotten". In certain circumstances a data subject may require you to delete their personal data — for example, when it is no longer necessary for its original purpose.
Right to restriction
A data subject may ask you to suspend processing of their data while a dispute is being resolved, rather than deleting it outright.
Right to object
Data subjects may object to processing carried out on the grounds of legitimate interests or for direct marketing purposes. You must stop unless you can demonstrate compelling legitimate grounds.
Right to portability
Where processing is automated and based on consent or contract, a data subject may ask you to provide their data in a structured, machine-readable format so they can transfer it to another organisation.
The 30-day rule
You must respond to a DSAR within 30 calendar days of receipt. The clock starts on the day the request arrives — not when you open the email. You may request a one-month extension for complex or numerous requests, but you must inform the data subject within the original 30 days. Failure to respond on time is a reportable breach to the OIC.
How Jamaica Privacy Hub helps
The DSAR module gives your team a single place to log, track, and respond to every request — replacing ad-hoc spreadsheets and missed deadlines.
Automatic deadline tracking
The 30-day deadline is calculated the moment you log a request. Colour-coded indicators tell you at a glance which requests are overdue, approaching, or on track.
Structured intake
The intake form captures all the information you need: requester details, whether they are the data subject themselves, the channel through which the request arrived, and the specific DPA right being exercised.
Status workflow
Requests move through a clear status pipeline — from identity verification through processing and review to dispatch. Every transition is logged with the actor and timestamp.
Audit trail
Every status change and internal note is recorded in an immutable activity log, giving you evidence of compliance if the OIC ever asks for it.
Dashboard visibility
Open requests, approaching deadlines, and overdue items surface directly on your dashboard so nothing slips through.
This guide is provided for educational purposes and does not constitute legal advice. Consult a qualified Jamaican attorney or the Office of the Information Commissioner for case-specific guidance.