Cayman Islands. Comprehensive data protection. Act
Cayman DPAData Protection Act (2021 Revision) (originally Data Protection Law, 2017)
In force
§1Summary
- Synopsis
UK-modelled data protection law with eight principles, rights, breach notification and an adequacy-based transfer regime, enforced by the Ombudsman.
- Key themes
- Unique features
5-day breach deadline; strong focus given financial services/fund sector.
- SaaS relevance
Funds and financial firms in Cayman using SaaS must ensure adequate protection for transfers and fast breach notice from processors.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Ombudsman and data subjects without undue delay, max 5 days
- DPO
- No
- Cross-border transfers
- Adequacy (EEA/EU-adequate treated as adequate) or exceptions
- Maximum penalty
- Monetary penalty up to KYD 250,000; criminal fine KYD 100,000 and/or 5 years
§3Dates
- Key dates
- Adopted
- In force
- Data Protection Regulations 2018; 2021 Revision
§4Text and authority
- Text
- Authoritative text ombudsman.ky
- Authority
- Office of the Ombudsman
§5Where it applies
- Domestic law of
- Cayman Islands
§6Sources and verification
- Sources consulted
- Verification
High confidence.