🇯🇲Data Protection Act, 2020
Data Protection Act, 2020 and Regulations
The Act applies eight standards covering fairness and transparency, purpose, minimisation, accuracy, retention, rights, security and international transfers. In-scope controllers must register before processing and renew registration annually; prescribed changes must be reported within 14 days.
Governance and incidents
Public authorities and controllers processing sensitive, criminal or large-scale data must appoint an independent DPO. Applicable controllers conduct an annual data-protection impact assessment within 90 days after the calendar year.
A contravention of the standards or security breach must be reported to the Commissioner within 72 hours of awareness, with affected-person notification handled in the prescribed manner. Access requests are generally due in 30 days, with a regulated extension available in defined circumstances.
Processor contracts, international-transfer safeguards, direct-marketing consent, automated-decision rights and documented retention and irreversible disposal complete the operational programme.