Data & Privacy - Cayman Islands

The Data Protection Act (2021 Revision) is an omnibus GDPR-style law that first came into force on 30 September 2019, governing the processing of personal data of identified or identifiable living individuals.

The Office of the Ombudsman is the supervisory authority. It investigates and decides complaints, receives breach notifications, issues guidance, and can order controllers to take or refrain from actions.

Controllers must comply with eight principles: fair and lawful processing, purpose limitation, data minimisation, accuracy, storage limitation, respect for data-subject rights, security, and restricted international transfers.

Individuals have rights of access, rectification, to stop processing for direct marketing (absolute), to withdraw consent, and to complain to the Ombudsman and seek compensation in the courts. Controllers must generally respond within 30 days.

Controllers must notify the Ombudsman (and affected data subjects) of a personal data breach without undue delay and in any event within five days of becoming aware, via the Ombudsman's online breach-notification form.

The Ombudsman can impose monetary penalty orders of up to CI$250,000 for serious contraventions; breaches can also be criminal offences punishable by fines (up to CI$100,000) and/or imprisonment of up to five years.