Cayman IslandsData Protection Act 2021 Revision, personal data breach notification
Data Protection Act (2021 Revision), s. 16 (personal data breaches)
In force since .
A breach notification rule binding public and private bodies.
- Enforcement body
- Office of the Ombudsman
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Ombudsman and each affected data subject of a personal data breach without undue delay and no later than five days after you should, with the exercise of reasonable diligence, have been aware of it, describing the breach, its consequences, and the measures taken or recommended (section 16(1)).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
A data controller who fails to notify the Ombudsman and the data subject of a personal data breach as section 16(1) requires commits an offence and is liable on conviction to a fine of one hundred thousand dollars.
Penalty structure
Section 16(2)'s fixed cap applies to a data controller's failure to notify a personal data breach as section 16(1) requires.
- Rule
- Fixed only
- As of
- Currency
- KYD
- Fixed cap
- 100,000
What it makes you log
Logging duty
Section 16(1) requires a controller to notify the data subject and the Ombudsman of a personal data breach within five days, describing its nature, consequences and the measures taken or recommended. It is a duty to notify, and the section says nothing about documenting, registering or keeping a record of breaches, whether or not notified. Section 16(2) sets the offence for failing to notify.
- Kind
- None
- As of
What this law does
On a personal data breach, a data controller must, without undue delay and no more than five days after it should reasonably have become aware of the breach, notify both the affected data subject and the Ombudsman, describing the nature and consequences of the breach, the measures taken or proposed to address it, and the measures recommended to the data subject to mitigate adverse effects. Failing to notify is an offence.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .