Data Protection Act, 2020, registration, lawful basis and standards for processing

Data Protection Act, 2020 (Act 7 of 2020), ss. 3, 14-20, 21(1), 22, 23, 25-30, 45

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

Register with the Office of the Information Commissioner before processing personal data, and keep your registration particulars in the register the Commissioner maintains.
Appoint a representative established in Jamaica if you are not established there but process the personal data of data subjects in Jamaica to offer them goods or services or to monitor their behaviour.
Have at least one condition under section 23 for every processing operation, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest that is not outweighed by the data subject's rights and freedoms.
Give the data subject your identity, the identity of your data protection officer, the purposes of the processing, the recipients you contemplate disclosing to, the expected retention period and the legal authority for seeking the data, before you first process it.
Obtain personal data only for one or more specified and lawful purposes, and do not further process it in a manner incompatible with those purposes.
Hold no more personal data than is adequate, relevant and limited to what is necessary for the purpose, keep it accurate and up to date, and do not keep it for longer than that purpose requires.
Take appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing of personal data and against its accidental loss, destruction or damage.
Engage a data processor only under a written contract under which it acts on your instructions alone and carries obligations equivalent to your own security measures.
Appoint a qualified data protection officer with no conflict of interest if you are a public authority, process sensitive personal data or data relating to criminal convictions, or process personal data on a large scale, and give the Commissioner that officer's name and contact information.
Submit a data protection impact assessment covering all personal data in your custody or control to the Information Commissioner within 90 days after the end of each calendar year.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Processing personal data for which registration is required without complying with section 16 is an offence under section 18(1), liable on summary conviction before a Parish Court to a fine not exceeding JMD 2,000,000 or imprisonment not exceeding six months (s. 18(3)). Carrying on processing the Minister has specified without the Commissioner's assessment is an offence under section 19(5), liable on summary conviction to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years, and on conviction on indictment to a fine or imprisonment not exceeding ten years. Processing personal data in contravention of a data protection standard is an offence under section 21(2), liable on summary conviction to a fine not exceeding JMD 2,000,000 or imprisonment not exceeding two years, and on conviction on indictment to a fine or imprisonment not exceeding seven years.

What it reaches

Obligation class

Licensing, Consent, Disclosure, Security, Retention, Governance, DPIA

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Act reaches a data controller established in Jamaica whose processing is carried out in the context of that establishment, and a controller established elsewhere that uses equipment in Jamaica or processes the personal data of a data subject who is in Jamaica in connection with offering goods or services to, or monitoring the behaviour of, data subjects in Jamaica, and a controller in the second class must appoint a representative established in Jamaica.

Section 15 prohibits a data controller from processing personal data unless its registration particulars are included in the register maintained by the Information Commissioner.

The first standard requires personal data to be processed fairly and lawfully and permits processing only where at least one condition in section 23 is met, such as the data subject's consent, the performance of a contract, a legal obligation, or a legitimate interest of the data controller that is not outweighed by the data subject's rights.

Fair processing also requires the data subject to be given the identity of the data controller and of its data protection officer, the purposes of the processing, the recipients contemplated, the expected retention period and the legal authority for seeking the data.

The second standard limits personal data to one or more specified and lawful purposes and bars further processing in a manner incompatible with those purposes, and the third, fourth and fifth standards require the data to be adequate, relevant and limited to what is necessary, to be accurate and up to date, and to be kept no longer than the purpose requires.

The seventh standard requires appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing and against accidental loss or destruction, and allows processing by a data processor only under a written contract under which the processor acts on the data controller's instructions alone and carries equivalent obligations.

Section 20 requires a public authority, a data controller processing sensitive personal data or data relating to criminal convictions, and a data controller processing personal data on a large scale, to appoint a qualified data protection officer who is free of any conflict of interest and monitors compliance in an independent manner.

Section 45 requires a data controller to submit a data protection impact assessment covering all personal data in its custody or control to the Commissioner within 90 days after the end of each calendar year.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

Read the law

Text of the Data Protection Act, 2020 as published by the Houses of Parliament of Jamaica

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app