On June 1, 2024, Jamaica’s Office of the Information Commissioner (OIC) began accepting applications for data controller registration as mandated by section 15 of the Data Protection Act of 2020. This marks the start of a phased compliance process following the Act’s initial enforcement in December 2021 and further sections activated in December 2023. 

The registration requirement represents a significant step for companies in Jamaica to publicly demonstrate their data protection compliance. The OIC has extended a six-month grace period, ending in June 2024, to help businesses align with the Act’s provisions. 

During the initial registration phase, which runs from June 1 to August 31, 2024, the OIC will prioritise applications from public authorities and data controllers processing personal data for 10,000 or more data subjects, particularly in sectors such as education, finance, health, ICT, and tourism. However, all data controllers, including sole proprietors and small to medium-sized enterprises (SMEs), are encouraged to register. 

Data controllers, as defined by the Act, include any person or public authority determining the purposes and means of processing personal data. This definition aligns with the GDPR. Notably, data controllers outside Jamaica must register before processing personal data of Jamaican subjects and must appoint local representatives. 

Registration requires detailed information, including the names and contact details of the data controller and data protection officer, conditions for processing personal and sensitive data, and estimated data subject numbers. The OIC also mandates descriptions of technical and organisational measures against unauthorised data processing and protocols for reporting data breaches. 

Failure to register can result in fines of up to USD 13,000 or imprisonment for up to six months. As data controllers work towards compliance, they must also focus on maintaining robust data protection programmes beyond mere registration. 

The OIC’s approach to enforcement will be closely watched as data protection remains a critical and evolving issue in Jamaica. As the country strengthens its data protection framework, companies must stay proactive in their compliance efforts to avoid penalties and contribute to a secure digital environment. 

HewardMills’ privacy experts are carefully tracking legal and regulatory developments across the world. Whether a new law is enacted or requirements under existing laws increase in scope and complexity, we can help your business adapt, excel and navigate compliance successfully.  

If you would like to discuss this topic or anything else data protection and privacy-related, please contact us at dpo@hewardmills.com.