Jamaica’s Data Protection Act: What Your Business Must Do

If your business keeps a customer list, staff files or CCTV footage, the Jamaica Data Protection Act applies to you. It covers banks and large companies, and it also covers the corner pharmacy and the small guest house. Here is what the law asks of a small business, and what you can do about it this week.

What the Data Protection Act covers

The Data Protection Act, 2020 sets the rules for how organisations in Jamaica collect, use, store and share personal information. Personal data is anything that can identify a living person: a name and phone number, a TRN, a copy of someone’s ID, a payroll record, even a clear image from a security camera.

The law calls anyone who decides why and how that information is used a “data controller.” For most small businesses, that is you. The regulator is the Office of the Information Commissioner (OIC).

The eight standards in plain English

The Act sets out eight data protection standards. In everyday terms, your business should:

1. Collect and use personal information fairly and lawfully, and tell people what you do with it.
2. Use it only for the reason you collected it.
3. Collect only what you actually need.
4. Keep it accurate and up to date.
5. Keep it no longer than necessary.
6. Respect people’s rights, including their right to see what you hold about them.
7. Keep it secure, with sensible technical and practical safeguards.
8. Send it outside Jamaica only where it will be properly protected.

The seventh standard is where most of the day-to-day work sits, and much of it is an IT job: who can log in, where files are stored, whether laptops are encrypted and whether backups exist. The eighth surprises people. If your email, accounting software or shared files live in the cloud, your data is probably stored outside Jamaica. That can be fine, but you should know where it is and how the provider protects it.

What the law asks your business to do

Every data controller has to register with the Information Commissioner and pay a fee. The OIC paused online registration in December 2025 while it upgrades its portal, and it has said businesses will not be held liable for processing data without registering while the portal is offline. Keep an eye on oic.gov.jm and register once it reopens.

Someone has to be responsible. Some organisations must formally appoint a data protection officer. Even if yours does not, give one person the job of looking after personal data and answering questions about it.

If personal data is lost, stolen or exposed, the Act requires you to report it to the Information Commissioner within 72 hours of finding out, and to notify the people affected. Three days goes quickly when you are also trying to work out what happened, so plan for it before you need it.

The Act also expects data controllers to look at the risks to the personal data they hold, in a data protection impact assessment, and submit it to the Commissioner each year unless the Commissioner says otherwise.

Where enforcement stands

In July 2026, the Information Commissioner told Parliament’s Public Accounts Committee that the OIC will not be ready to fully enforce the Act until 2028. The office is still hiring staff and upgrading its systems. She also made it clear that businesses must follow the law in the meantime.

When enforcement does arrive, companies can be fined up to 4% of their annual gross worldwide turnover, and some failures, such as not reporting a breach, are criminal offences. The more immediate reason to act is trust. Customers and staff hand you their details expecting you to look after them, and a breach damages that relationship long before any fine.

What to do this week

1. List the personal data you hold (customer details, staff files, ID copies, CCTV) and where each one lives: paper, laptops, email or the cloud.
2. Delete what you no longer need, and shred old paper records.
3. Turn on two-step login (multi-factor authentication) for email and any system that holds customer or staff details.
4. Make sure your backups are encrypted and that someone has actually tested a restore. Our guide to backups for Jamaican businesses explains what a good setup looks like.
5. Write a one-page breach plan: who decides what happens, who contacts the OIC, and how you will reach the people affected within 72 hours.
6. Add a short privacy notice to your website and forms explaining what you collect and why.
7. Choose the person responsible for data protection and put it in writing.

This article is general information, not legal advice. For questions about your own situation, speak with an attorney or contact the Office of the Information Commissioner.

Not sure how your business measures up? Techwhizz Network Solutions can look at how your email, files, backups and computers are secured, and tell you in plain English what we would fix first. Book a free IT check-up or call (876) 799-7214.