Cayman IslandsData Protection Act 2021 Revision, cross-border transfer of personal data
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not transfer personal data outside the Islands unless the receiving country or territory ensures an adequate level of protection for data subjects, or a Schedule 4 exception (consent, contractual necessity, or Ombudsman-approved terms) applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The eighth principle bars a transfer to a country or territory without an adequate level of protection, and Schedule 4 lists the transfers it does not reach. Neither states a duty to create, keep or produce a log or record of transfers. The cited sections carry no territorial scope clause of their own (the Act's scope is in section 6, which this instrument does not cite).
- Kind
- None
- As of
What this law does
The eighth data protection principle bars transferring personal data to a country or territory that does not ensure an adequate level of protection for the rights and freedoms of data subjects. Schedule 4 lists transfers to which this principle does not apply, including a transfer with the data subject's consent, one necessary to perform a contract with the data subject, one made on terms the Ombudsman approves as ensuring adequate safeguards, and one the Ombudsman has itself authorised.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .