LexLint.ioBeta

Know the law your code answers to.

Law / Cayman Islands

Data Protection Act 2021 Revision, application, principles and data subject rights

Data Protection Act (2021 Revision), Law 33 of 2017, ss. 1-14 (application, principles and data subject rights)

In force since .

A comprehensive regime rule binding public and private bodies.

Audit expectation
none

What it requires

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
  • MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
NIST Privacy Framework
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

Section 55(1) lets the Ombudsman serve a monetary penalty order for a serious contravention of the Act that was of a kind likely to cause substantial damage or substantial distress to the data subject; section 55(3) caps the amount at two hundred and fifty thousand dollars. A contravention of the principles or of sections 8 to 14 is not itself an offence; failing to comply with an enforcement order or monetary penalty order is (section 46(1)).

Rule
Fixed only
As of
Currency
KYD
Fixed cap
250,000

Who enforces it

Enforcement body

Office of the Ombudsman, which hears, investigates and rules on complaints and monitors compliance by data controllers under the Act.

Settledness

The Ombudsman's published guidance on monetary penalty orders construes the section 55 penalty power and not the duties in sections 1 to 14.

As of
Open questions
Which decisions "significantly affect" a data subject under section 12(1) and (2) of the Data Protection Act (2021 Revision), a phrase the Act does not define?

What it reaches

How the hook was established

express

What makes it apply

Operator establishment

Obligation class

Data subject rights, Consent, Disclosure

Applicability criteria

As of
Combinator
Any of
Criteria
  • the data controller is established in the Islands and the personal data are processed in the context of that establishment
  • the data controller is not established in the Islands but the personal data are processed in the Islands otherwise than for the purposes of transit of the data through the Islands

What it makes you log

Logging duty

Sections 1 to 14 fix the Act's scope, require a controller outside the Islands to nominate a local representative, and give a data subject rights to be informed of, rectify and object to processing. Each of these asks a controller to respond or act; none states a duty to create, keep or produce a log or record. The data protection principles (security measures, no keeping of personal data longer than necessary) bind the personal data itself and name no record. Section 6(1)(b) also reaches a controller established elsewhere whose processing takes place in the Islands other than in transit; that prong turns on where the processing happens and carries no hook value, so only the establishment prong is coded.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Act binds a data controller established in the Islands, or one processing personal data in the Islands otherwise than in transit, to collect personal data fairly and lawfully, hold it only for specified purposes, keep it accurate, and secure it against unauthorised access.

A data subject may access personal data held about them, require a controller to stop processing or to stop processing for direct marketing, and object to a decision based solely on automated processing of their personal data that significantly affects them. A person who suffers damage from a data controller's contravention of the Act has a statutory cause of action for compensation.

When LexLint raises it

When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.

Back to the example  ·  Lint your app

Page updated .