Processes personal data, in the Cayman Islands

Data Protection Act (2021 Revision), Law 33 of 2017, ss. 1-14 (application, principles and data subject rights) · Read the law's page

• Have a lawful basis for collecting and processing personal data, and hold it only for specified purposes.
• Give a data subject access to their personal data on request, and let them object to processing or to processing for direct marketing.
• Do not base a decision that significantly affects a data subject solely on automated processing of their personal data without notifying them and honouring a request to reconsider.

Data Protection Act (2021 Revision), Schedule 1 (eighth principle) and Schedule 4 (transfers to which the eighth principle does not apply) · Read the law's page

• Do not transfer personal data outside the Islands unless the receiving country or territory ensures an adequate level of protection for data subjects, or a Schedule 4 exception (consent, contractual necessity, or Ombudsman-approved terms) applies.

Data Protection Act (2021 Revision), s. 16 (personal data breaches) · Read the law's page

• Notify the Ombudsman and each affected data subject of a personal data breach without undue delay and no later than five days after you should, with the exercise of reasonable diligence, have been aware of it, describing the breach, its consequences, and the measures taken or recommended (section 16(1)).

Data Protection Act (2021 Revision), ss. 52-57 (Ombudsman investigatory powers, monetary penalties and offences) · Read the law's page

• Cooperate with a warrant executed under section 52 to investigate a suspected contravention of the data protection principles or an offence under the Act.
• Pay a monetary penalty order the Ombudsman serves for a serious contravention, or make written representations within twenty-one days of a notice of intent.