JamaicaData Protection Act, 2020, reporting a contravention or security breach
Data Protection Act, 2020 (Act 7 of 2020), ss. 21(2)-(5), 30(1)(b), (4)-(5)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Report any security breach in respect of your operations which affects or may affect personal data, and any contravention of the data protection standards, to the Information Commissioner within 72 hours of becoming aware of the breach or contravention, in the prescribed form and manner.NIST Privacy FrameworkCM.AW-P7
- Notify the Information Commissioner without undue delay of any breach of your security measures which affects or may affect personal data.NIST Privacy FrameworkCM.AW-P7
- Notify each data subject whose personal data is affected by the breach, upon becoming aware of the breach or having reason to become aware of it, of the nature of the breach, of the measures taken or proposed to address it, and of your data protection officer's contact information, in the form, manner and time prescribed.NIST Privacy FrameworkCM.AW-P7
- Set out in the report to the Information Commissioner the facts of the breach, its nature including the categories and number of data subjects and the type and number of personal data concerned, the measures taken or proposed to mitigate it, its consequences, and your data protection officer's contact information.NIST Privacy FrameworkCM.AW-P7
- Engage a data processor only where it gives sufficient guarantees as to the reporting of security breaches to you, under a written contract binding it to obligations equivalent to your own.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkID.DE-P2
- Expect the Information Commissioner, on receiving your report, to serve an enforcement notice or to direct you to tell affected data subjects what the Commissioner thinks fit about the breach and the measures addressing it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to make a report required by section 21(3) or a notification required by section 21(5) is an offence under section 21(2), liable on summary conviction in a Parish Court to a fine not exceeding JMD 2,000,000 or imprisonment not exceeding two years, and on conviction on indictment in a Circuit Court to a fine or imprisonment not exceeding seven years. It is a defence under section 21(7) to show, on the balance of probabilities, that the person exercised all due diligence to prevent the commission of the offence. Section 62 lets the Information Commissioner offer a data controller a fixed penalty notice for a section 21(2) offence instead of prosecution where the contravention was of a kind likely to cause substantial damage or distress and was deliberate or negligent.
Penalty structure
Section 21(2) states the scale for failing to make the report or notification: on summary conviction in a Parish Court a fine not exceeding JMD 2,000,000 or imprisonment not exceeding two years, and on conviction on indictment in a Circuit Court an unspecified fine or imprisonment not exceeding seven years. Section 68(1) applies notwithstanding any other penalty specified in the Act, so where the data controller is a body corporate the fine for that offence is capped instead at four percent of its annual gross worldwide turnover for the preceding year of assessment.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 4
What it makes you log
Logging duty
Section 21(3) to (5) makes the controller report a contravention of the standards or a security breach to the Commissioner within seventy-two hours, setting out the facts, nature, categories and number of data subjects, mitigation, consequences and the data protection officer's contact details, and notify each affected data subject. Section 30(1)(b) separately requires notice to the Commissioner without undue delay. These are notices, and no provision of the cited sections makes the controller document breaches in a record kept for the authority to check, so no record duty is found. The Commissioner may then serve an enforcement notice or direct what data subjects are told, which is a response to a report and not an audit of a record. No scope clause is stated in the cited provisions.
- Kind
- None
- As of
What this law does
Section 21(3) requires a data controller to report to the Commissioner, in such form and manner as shall be prescribed, any contravention of the data protection standards and any security breach in respect of the data controller's operations which affects or may affect personal data, within seventy-two hours after becoming aware of the contravention or security breach.
The report must set out the facts surrounding it, a description of its nature including the categories and number of data subjects concerned and the type and number of personal data concerned, the measures taken or proposed to mitigate or address its possible adverse effects, its consequences, and the name, address and contact information of the data controller's data protection officer.
Section 21(5) requires the data controller, upon becoming aware of or having reason to become aware of the contravention or breach, to notify each data subject whose personal data is affected of its nature, of the measures taken or proposed to mitigate or address its possible adverse effects, and of the data protection officer's contact information.
That notification is to be given in such form and manner, and within such time, as shall be prescribed, and the Act states no period of its own for it. The seventh standard separately requires appropriate measures to ensure that the Commissioner is notified, without any undue delay, of any breach of the data controller's security measures which affect or may affect any personal data.
The same standard requires a data controller using a data processor to choose one that gives sufficient guarantees as to the reporting of security breaches to the data controller, and to bind it by written contract to obligations equivalent to the controller's own. On receiving a report the Commissioner may serve an enforcement notice or direct the data controller to give affected data subjects such information about the contravention or breach as the Commissioner thinks fit.
Failing to make a report or notification required by section 21(3) or (5) is an offence under section 21(2). The Act has been in force since , the day the Government of Jamaica confirmed as the Act's implementation date.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .