Data Management
Is Your Business Sending Personal Data Outside Jamaica?
How everyday tools like cloud hosting and overseas support can create cross-border data transfers, and what Jamaican businesses should document.
Intermediate 8 min
This module is general information, not legal advice, and is being reviewed by our legal team. For your specific situation, consult the official Data Protection Act, 2020 or seek professional advice.
What you will learn
- How transfers arise through everyday technology
- Why a transfer is not just a spreadsheet emailed overseas
- What to document for each transfer
- How to check where your cloud provider stores information
Ask a business owner, "Do you export customer information?" They may answer no. Then ask: where is your email hosted? Where does your cloud backup live? Where are your website servers? Can overseas support staff access your system?
The answer may suddenly change.
A transfer is not necessarily a spreadsheet emailed overseas
Cross-border processing can arise through:
- cloud hosting;
- SaaS applications;
- remote access;
- overseas support;
- international payroll providers;
- CRM platforms;
- backups;
- analytics platforms; and
- affiliated companies.
What should you document?
For each transfer:
- country;
- recipient;
- system;
- data categories;
- purpose;
- frequency;
- applicable safeguards;
- contractual arrangements; and
- review date.
Do not guess where your cloud provider stores information
Check the provider's contract, privacy documentation and service configuration.
Legal note. This module is general information about Jamaica's Data Protection Act, 2020, not legal advice. For your situation, consult the Act or a qualified professional.
Put this into practice
Record cross-border flows and safeguards within your Personal Data Register.
Check My International TransfersFrequently asked questions
It can. If the provider stores or processes your data outside Jamaica, or overseas staff can access it, cross-border considerations may arise.
Key takeaways
- Cross-border processing can arise through cloud hosting, SaaS, remote access and backups.
- A transfer is not only a file emailed overseas.
- Document the country, recipient, system, data, purpose and safeguards for each transfer.
- Check the provider's contract and configuration rather than guessing where data is stored.