Cayman IslandsData Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Office of the Ombudsman
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- Cooperate with a warrant executed under section 52 to investigate a suspected contravention of the data protection principles or an offence under the Act.
- Pay a monetary penalty order the Ombudsman serves for a serious contravention, or make written representations within twenty-one days of a notice of intent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
A person who commits an offence under the Act, except where the Act otherwise provides, is liable on summary conviction to a fine of ten thousand dollars or on conviction on indictment to a fine of twenty thousand dollars, under section 57(1), in addition to any monetary penalty the Ombudsman imposes under section 55.
Penalty structure
Section 55(3) caps a monetary penalty order the Ombudsman may serve for a serious contravention likely to cause substantial damage or distress at two hundred and fifty thousand dollars. A general offence under the Act carries a separate, lower criminal fine (ten thousand dollars summary, twenty thousand dollars on indictment) under section 57(1), which is not folded into this cap because it runs on a different, criminal track.
- Rule
- Fixed only
- As of
- Currency
- KYD
- Fixed cap
- 250,000
What it makes you log
Logging duty
Sections 52 to 57 limit the powers a warrant carries (section 52), make obstruction of a warrant and false statements offences (section 53), create the unlawful-obtaining offence (section 54), and set the Ombudsman's monetary penalty power, its guidance and the general offence penalties (sections 55 to 57). A person must assist and not obstruct a warrant's execution, but none of these sections requires a controller to create, keep or produce a log or record. The warrant power itself is in section 51, which this instrument does not cite.
- Kind
- None
- As of
What this law does
The Office of the Ombudsman enforces the Act. A judge may grant the Ombudsman a warrant to enter and search premises and inspect or seize equipment and documents where there are reasonable grounds to believe a data controller has contravened the data protection principles or committed an offence.
The Ombudsman may serve a data controller with a monetary penalty order, capped at two hundred and fifty thousand dollars, for a serious contravention likely to cause substantial damage or distress, after a twenty-one day notice-of-intent period. A general offence under the Act is liable, except where the Act otherwise provides, to a fine of ten thousand dollars on summary conviction or twenty thousand dollars on conviction on indictment.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .