← Global Privacy Laws Research Library
Jamaica Data Protection Act, 2020
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE (phased commencement)
- Legal character
- Statute
- Region
- Latin America
- Enacted
- 2020
What it covers
Jamaica's comprehensive data-protection statute. It sets eight data-protection standards for data controllers, gives data subjects rights of access, to prevent processing, to object to direct marketing and in relation to automated decisions, requires controllers to register with the Information Commissioner and in some cases appoint a data protection officer, regulates transfers outside Jamaica and security breaches, and provides for enforcement notices, assessments and offences.
Why it matters
It is a GDPR-influenced regime applying to controllers in Jamaica and to some controllers outside Jamaica that process data there.
Refer to it when
Use it for processing personal data in Jamaica, registration with the Information Commissioner, data-subject requests, breaches or direct marketing.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: Moderate
AI
MODERATE RELEVANCE
Rights in relation to automated decision-making.
Privacy
VERY HIGH RELEVANCE
Comprehensive data-protection statute.
Cybersecurity
MODERATE RELEVANCE
Security standard and breach reporting.
Applicability
Data controllers established in Jamaica, or using equipment in Jamaica to process personal data.
Current validity
CURRENT. Commencement was phased by order; check the Office of the Information Commissioner for the dates of individual provisions. The supplied PDF is a scanned copy. Read the official PDF on this page for the operative text.
Read first
Preliminary and definitions → data-protection standards → data-subject rights → registration → Information Commissioner and enforcement.
Provisions / sections covered
Data-protection standards
Fair and lawful processing, purpose limitation, adequacy, accuracy, retention, rights of data subjects, security and limits on transfer outside Jamaica.
Data-subject rights
Access, prevention of processing likely to cause damage or distress, direct-marketing objection, automated decision-making and rectification.
Registration and DPO
Controllers register with the Information Commissioner; certain controllers appoint a data protection officer.
Enforcement
Assessments, enforcement notices and offences.
Subject-matter tags
- Lawful basis
- Data subject rights
- Automated decision-making
- Cross-border transfers
- Data protection officer
- Controller and processor
- Direct marketing
- Retention
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.