Cayman Islands

The Cayman Islands has no AI-transparency, AI-risk-obligations, AI-training-data, AI-governance, or AI-sector-rules statute in force.

The Penal Code (2019 Revision) bans an indecent photograph or pseudo-photograph of a child, defining a pseudo-photograph as an image made or produced by computer-graphics or otherwise which appears to be a photograph, and child pornography as including a realistic image representing a child engaged in sexually explicit conduct; this reaches a computer-generated or AI-synthesised depiction with no real child involved.

The government has been developing AI policy since early 2026: a draft Civil Service Artificial Intelligence Policy remained in final signoff at the Office of the Deputy Governor and unpublished as of the most recent reporting found, and the Premier told Parliament in a 6 March 2026 written answer that a draft AI legislative framework, not yet decided as a standalone Act or amendments to existing law, was targeted for Q2 2027; neither has produced a tabled bill or published policy text as of this review.

The Cayman Islands' comprehensive personal-data statute is the Data Protection Act (2021 Revision), consolidating the Data Protection Law, 2017 (Law 33 of 2017), in force from 30 September 2019 and enforced by the Office of the Ombudsman.

It binds a data controller established in the Islands, or processing personal data in the Islands, to eight data protection principles, gives data subjects access, rectification, objection and automated-decision-making rights, a statutory cause of action for compensation, and restricts transfer of personal data outside the Islands unless the receiving country or territory ensures an adequate level of protection.

The Act's sensitive personal data category does not name biometric or genetic-derived identifiers beyond genetic data itself, and its only publicity-based carve-out reaches information a controller is itself obliged by enactment to make public, not personal data that is merely publicly accessible.

Open-web crawling of a public unauthenticated page is not addressed by a computer-misuse statute in the Cayman Islands: no Computer Misuse Act, Cybercrime Act, or equivalent unauthorised-access offence was found in the current Acts index of the Cayman Islands Legislation portal or in the Penal Code (2019 Revision), whose only computer-related provisions (sections 225, 228A-228C) are scoped to child pornography.

Copyright law is the United Kingdom's Copyright, Designs and Patents Act 1988, Part 1, as extended to the Cayman Islands by the Copyright (Cayman Islands) Order 2015, subject to named exclusions and modifications; within Part 1, a database is protected as a literary work in its own right alongside a table or compilation, with no separate sui generis database right extended to the Islands, and section 29A permits copying a work for text and data analysis for non-commercial research by a person with lawful access, a term purporting to restrict which is unenforceable.

Personal data collected by scraping falls within the Data Protection Act (2021 Revision) researched under the privacy topic. No unfair-competition or misappropriation doctrine, and no statute or case law addressing the legal weight of a robots.txt instruction or an AI-training-specific rule, was identified in the legislation read.

The Cayman Islands has no enacted product-security or connected-device statute: no law requires a manufacturer to meet security requirements before or after placing a software product or connected device on the Cayman Islands market was located, and no voluntary IoT security labelling scheme comparable to Singapore's Cybersecurity Labelling Scheme was found either.

The Islands also have no general reasonable-security or information-security-programme statute reaching a business simply because it holds covered information; the nearest analogue is the Data Protection Act (2021 Revision) Schedule 1, Seventh Principle, which requires that appropriate technical and organisational measures be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, and section 16, which requires a data controller to notify both the affected data subject and the Ombudsman of a personal data breach without undue delay and no later than five days after the controller should reasonably have become aware of it; both are this jurisdiction's own privacy-topic security-safeguards principle and breach-notification duty and are not repeated here.

The Cayman Islands Monetary Authority (CIMA) has, since May 2020 and most recently reissued in April 2023, a binding Rule on Cybersecurity for Regulated Entities and a companion Statement of Guidance, made under section 34(1)(a) of the Monetary Authority Act, which lets the Authority, after private sector consultation, issue rules or statements of principle or guidance concerning the conduct of licensees and their officers and employees.

The Rule applies to entities regulated by the Authority, including controlled subsidiaries as defined in the Banks and Trust Companies Act, but excepting Regulated Mutual Funds and Private Funds, and requires a regulated entity to establish, implement and maintain a documented cybersecurity framework designed to identify, measure, assess, report, monitor and control cybersecurity risks and to respond to and recover from cybersecurity breaches with a material impact on its operations; makes a regulated entity's governing body ultimately responsible for cybersecurity, including approval of a written cybersecurity risk management strategy and a comprehensive cybersecurity framework; requires immediate written notification to the Authority of an incident with a material impact or the potential to become one, no later than 72 hours after discovery; and requires notification to affected persons where a cyber attack breaches non-public information or disrupts a utilised service.

Every one of these duties binds only an entity the Authority has already licensed or otherwise regulates under one of its sectoral Acts; the Rule on Cybersecurity for Regulated Entities is filed as rows of its own.

Separately, the Information and Communications Technology Act (2026 Revision) defines "critical ICT infrastructure" as ICT systems and assets, whether physical or virtual, that are so vital to the Islands that their incapacity or destruction would have a debilitating impact on security, national economic security, or national public health or safety, and gives the Utility Regulation and Competition Office (OfReg) the function of setting up, managing and controlling the Cayman Islands cyber incident response team (CIRT-KY), whose role is to promote and enhance the security and resilience of critical ICT infrastructure, of developing and maintaining cyber security strategies, and of making regulations relating to critical ICT infrastructure after consultation with the Minister.

No regulation made under that power, and no instrument designating a person as an operator of critical ICT infrastructure or imposing a security or incident-reporting duty on one, was located: as drafted this is an enabling power and a description of OfReg's and CIRT-KY's own functions, not yet a duty running to a private operator, and CIRT-KY's public activity to date reads as a voluntary alerting and incident-response service rather than a mandatory reporting regime.

The Cayman Islands Computer Misuse Law (2015 Revision) criminalises unauthorised access to, and unauthorised modification of, computer material by an intruder and is this jurisdiction's scraping-topic computer-misuse row, not repeated here; its current sections name no distinct critical-infrastructure offence. The Rule on Cybersecurity for Regulated Entities requires regulated entities to establish, implement and maintain a documented cybersecurity framework.

The Rule on Cybersecurity for Regulated Entities requires a regulated entity to notify the Authority in writing of a material incident immediately and no later than 72 hours following its discovery.

The Cayman Islands has no press-publisher neighbouring right and no platform-to-publisher bargaining code.

Copyright law is the United Kingdom's Copyright, Designs and Patents Act 1988, Part 1, as extended to the Cayman Islands by the Copyright (Cayman Islands) Order 2015, and section 30's fair dealing exceptions for criticism, review, quotation and reporting current events extend with it, requiring a sufficient acknowledgement except where reporting current events by sound recording, film or broadcast makes one impracticable.

No statute or reported Cayman Islands decision addresses hyperlinking, framing, hot-news misappropriation, or a machine-readable text-and-data-mining opt-out specific to news content.