Jamaica. Comprehensive data protection. Act

Jamaica DPAData Protection Act, 2020

In force

Partly verified

Medium confidence. 1 Dec 2023 commencement and 4% turnover cap from general knowledge (penalty sections were truncated in fetched text).

§1Summary

Synopsis

GDPR-style law with eight data protection standards, data subject rights, registration of controllers, DPO requirements and breach reporting, enforced by the Information Commissioner.

Key themes

data protection standards
registration
DPO
DPIA
72h breach reporting
transfers
Commissioner

Unique features

Mandatory registration of data controllers with annual fees; turnover-based fines for organisations.

SaaS relevance

Applies to controllers established in Jamaica or using equipment in Jamaica; SaaS customers must register and impose standards on processors.

§2Obligations

Extraterritorial: Limited
Breach notification: Commissioner within 72h; data subjects as prescribed
DPO: Conditional
Cross-border transfers: Adequacy standard with consent/contract/Commissioner-approved exceptions
Maximum penalty: Up to 4% of annual gross worldwide turnover (organisations); fines up to JMD 5m and imprisonment

§3Dates

Key dates

Adopted 19 June 2020
In force 1 December 2023
Partially commenced 2021 (Information Commissioner); substantive obligations from 2023-12-01 after transition; 2024 Data Controller Registration Regulations and Minister's Regulations

§4Text and authority

Text

Authoritative text japarliament.gov.jm

Authority

Office of the Information Commissioner (OIC)

§5Where it applies

Domestic law of: Jamaica

§6Sources and verification

Sources consulted

Verification

Medium confidence.

Partly verified

Medium confidence. 1 Dec 2023 commencement and 4% turnover cap from general knowledge (penalty sections were truncated in fetched text).