← Back to Jamaica DPA Accelerator: Fundamentals
What is the Data Protection Act (2020)?
Every business in Jamaica — from a one-person shop in Savanna-la-Mar to a bank in New Kingston — handles personal data: customer names, phone numbers, TRNs, payroll records, CCTV footage. The Data Protection Act, 2020 (JDPA) is the law that governs how all of that information must be collected, used, stored, and destroyed.
Why the Act exists
Before the JDPA, Jamaica had no comprehensive privacy law. Customer lists were sold, records were dumped in open bins, and individuals had no legal way to find out what companies knew about them. The Act, passed in 2020 and brought into force in phases, changed that. It aligns Jamaica with international frameworks like the EU’s GDPR — which matters commercially, because overseas partners increasingly refuse to send data to countries without adequate protection laws.
Who the Act applies to
The Act applies to data controllers (anyone who decides why and how personal data is processed) and data processors (anyone processing data on a controller’s behalf). Size does not matter. A church keeping a members register, a school storing report cards, a BPO handling overseas customer calls, and a doctor’s office in Westmoreland are all covered.
What counts as “personal data”
Any information relating to a living individual who can be identified from it: names, addresses, TRN, NIS number, photographs, IP addresses, location data, voice notes. A special class called sensitive personal data — health records, biometric data, criminal history, religious beliefs, trade union membership, and more — carries stricter rules, which you will meet later in this course.
A microfinance company in Montego Bay closes a branch and leaves boxes of loan applications — with TRNs and bank details — at the curb. Under the JDPA this is a security failure by the data controller, exposing the company to enforcement action and reputational damage, even though no hacker was involved. Most breaches in the Caribbean are physical and careless, not sophisticated.
The cost of getting it wrong
The Act carries real teeth: enforcement notices, fines, and in serious cases penalties that can be calculated as a percentage of a company’s annual gross income, along with possible criminal liability for officers of the company. Just as damaging is the loss of customer trust — in a small market like Jamaica, word travels fast.
Quick check: Your company only has 4 employees and 200 customers. Does the JDPA apply to you?
Yes. The Act has no minimum company size. If you process personal data about living individuals in Jamaica, you are covered. Small organisations may have simpler obligations in practice, but the 8 Standards apply to everyone.
Quick check: Is a customer’s work email address “personal data”?
Yes, if it identifies an individual (e.g. jbrown@company.com). Generic addresses like info@company.com generally are not, because they do not relate to an identifiable person.
- The JDPA governs how every organisation in Jamaica collects, uses, stores, and destroys personal data.
- It applies regardless of company size or sector — controllers and processors alike.
- Personal data is anything that can identify a living individual; sensitive personal data gets stricter rules.
- Penalties include enforcement action and significant fines — and most breaches are careless, not high-tech.