Law / Jamaica

Data Protection Act, 2020, registration, lawful basis and standards for processing

Data Protection Act, 2020 (Act 7 of 2020), ss. 3, 14-20, 21(1), 22, 23, 25-30, 45

In force since 1 Dec 2023.

A comprehensive regime rule binding public and private bodies.

How the hook was established: express
What makes it apply: Operator establishment, Market targeting, User location
Obligation class: Licensing, Consent, Disclosure, Security, Retention, Governance, DPIA
Audit expectation: periodic
Who audits it: Self
Where the report goes: Filed with regulator

What it requires

Register with the Office of the Information Commissioner before processing personal data, and keep your registration particulars in the register the Commissioner maintains.NIST Privacy FrameworkGV.PO-P5
Appoint a representative established in Jamaica if you are not established there but process the personal data of data subjects in Jamaica to offer them goods or services or to monitor their behaviour.NIST Privacy FrameworkGV.PO-P5
Have at least one condition under section 23 for every processing operation, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest that is not outweighed by the data subject's rights and freedoms.NIST Privacy FrameworkCT.PO-P1
Give the data subject your identity, the identity of your data protection officer, the purposes of the processing, the recipients you contemplate disclosing to, the expected retention period and the legal authority for seeking the data, before you first process it.NIST Privacy FrameworkCM.AW-P1
Obtain personal data only for one or more specified and lawful purposes, and do not further process it in a manner incompatible with those purposes.NIST Privacy FrameworkGV.PO-P1
Hold no more personal data than is adequate, relevant and limited to what is necessary for the purpose, keep it accurate and up to date, and do not keep it for longer than that purpose requires.NIST Privacy FrameworkGV.PO-P1
Take appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing of personal data and against its accidental loss, destruction or damage.NIST Privacy FrameworkPR.DS-P5
Engage a data processor only under a written contract under which it acts on your instructions alone and carries obligations equivalent to your own security measures.NIST Privacy FrameworkID.DE-P3
Appoint a qualified data protection officer with no conflict of interest if you are a public authority, process sensitive personal data or data relating to criminal convictions, or process personal data on a large scale, and give the Commissioner that officer's name and contact information.NIST Privacy FrameworkGV.PO-P3
Submit a data protection impact assessment covering all personal data in your custody or control to the Information Commissioner within 90 days after the end of each calendar year.NIST Privacy FrameworkID.RA-P4

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.

2 more

CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureYes

Criminal exposure note

Processing personal data for which registration is required without complying with section 16 is an offence under section 18(1), liable on summary conviction before a Parish Court to a fine not exceeding JMD 2,000,000 or imprisonment not exceeding six months (s. 18(3)). Carrying on processing the Minister has specified without the Commissioner's assessment is an offence under section 19(5), liable on summary conviction to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years, and on conviction on indictment to a fine or imprisonment not exceeding ten years. Processing personal data in contravention of a data protection standard is an offence under section 21(2), liable on summary conviction to a fine not exceeding JMD 2,000,000 or imprisonment not exceeding two years, and on conviction on indictment to a fine or imprisonment not exceeding seven years.

What it makes you log

Logging duty

The Act names no log or record the controller keeps. Registration particulars (s 16) are a filing entered in the Commissioner's public Register (s 17), which is the Commissioner's own record, and the annual data protection impact assessment (s 45) is the controller's own review filed with the Commissioner, recorded under the audit keys. The 'uses equipment in Jamaica' prong of s 3(1) has no hook value and is left out.

Kind: None
As of: 28 October 2026

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Act reaches a data controller established in Jamaica whose processing is carried out in the context of that establishment, and a controller established elsewhere that uses equipment in Jamaica or processes the personal data of a data subject who is in Jamaica in connection with offering goods or services to, or monitoring the behaviour of, data subjects in Jamaica, and a controller in the second class must appoint a representative established in Jamaica.

Section 15 prohibits a data controller from processing personal data unless its registration particulars are included in the register maintained by the Information Commissioner.

The first standard requires personal data to be processed fairly and lawfully and permits processing only where at least one condition in section 23 is met, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest of the data controller that is not outweighed by the data subject's rights.

Fair processing also requires the data subject to be given the identity of the data controller and of its data protection officer, the purposes of the processing, the recipients contemplated, the expected retention period and the legal authority for seeking the data.

The second standard limits personal data to one or more specified and lawful purposes and bars further processing in a manner incompatible with those purposes, and the third, fourth and fifth standards require the data to be adequate, relevant and limited to what is necessary, to be accurate and up to date, and to be kept no longer than the purpose requires.

The seventh standard requires appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing and against accidental loss or destruction, and allows processing by a data processor only under a written contract under which the processor acts on the data controller's instructions alone and carries equivalent obligations.

Section 20 requires a public authority, a data controller processing sensitive personal data or data relating to criminal convictions, and a data controller processing personal data on a large scale, to appoint a qualified data protection officer who is free of any conflict of interest and monitors compliance in an independent manner.

Section 45 requires a data controller to submit a data protection impact assessment covering all personal data in its custody or control to the Commissioner within 90 days after the end of each calendar year.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.