Getting Started
Understanding the Jamaica Data Protection Act
A plain-language introduction to the Data Protection Act, 2020, who it applies to, and what it means for your business.
What you will learn
- What the Data Protection Act is and why it exists
- Who must comply with the Act
- The role of the Office of the Information Commissioner
- Your main responsibilities as a business
Overview
The Data Protection Act, 2020 is Jamaica's main privacy law. It sets out how organisations must handle the personal data of individuals, and it gives people rights over the information that businesses and public bodies hold about them.
If your business collects names, phone numbers, email addresses, customer records, employee files, or any other information about identifiable people, this law applies to you.
Why this matters
People share a lot of personal information with the businesses they deal with. The Act exists to make sure that information is handled responsibly, kept secure, and used only in ways people would reasonably expect.
For your business, taking this seriously builds trust with customers, reduces the risk of complaints and penalties, and makes you more resilient if something ever goes wrong.
What the law says
The Act is built around a set of data protection standards (set out in sections 22 to 31 of the Act) that describe how personal data must be handled. In plain terms, personal data must be:
- processed fairly and lawfully
- collected for clear, specific purposes
- adequate and relevant, not excessive
- accurate and kept up to date
- kept no longer than necessary
- handled in line with people's rights
- kept secure
- transferred outside Jamaica only with appropriate protection
The Act also creates the Office of the Information Commissioner (), the body responsible for overseeing data protection in Jamaica.
Who must comply
The Act applies to data controllers, which means any person or organisation that decides how and why personal data is processed. That includes companies, sole traders, schools, clinics, churches, and non-profits.
It applies whether you keep records on paper or on a computer, and whether you have one employee or one thousand.
What happens if you do not comply
The Act gives the Office of the Information Commissioner powers to investigate, to require organisations to fix problems, and to take enforcement action. Beyond any formal penalties, failing to protect personal data can cause lasting damage to your reputation and your customers' trust.
Common misconceptions
- "We are too small to be covered." Size does not exempt you. What matters is that you handle personal data.
- "We only keep paper records." Paper records are covered too.
- "Consent is always required." Consent is one lawful basis for processing, but not the only one.
- "Compliance is a one-time task." It is ongoing. Data, systems, and staff change over time.
Benefits of compliance
Good data protection is good business. It reduces risk, it is increasingly expected by partners and customers, and it forces helpful discipline: knowing what data you hold, why you hold it, and how you keep it safe.
Put this into practice
Once you understand the basics, the fastest first step is a clear privacy notice that tells people how you use their data.
Generate your privacy noticeFrequently asked questions
Key takeaways
- The Act gives people rights over their personal data and places duties on the businesses that hold it.
- It applies to almost every organisation in Jamaica that handles personal data, regardless of size.
- The Office of the Information Commissioner oversees the Act and handles complaints.
- Compliance is mostly about being transparent, careful, and accountable with the data you hold.