Cybersecurity law & regulation in Jamaica (2026)

Minister Andrew Wheatley announced in the House of Representatives that Jamaica will draft a new standalone cybersecurity law after recording over 49 million attempted attacks in 2025. The planned legislation will codify a National Cybersecurity Directorate, mandate minimum sector standards, require incident reporting, regulate cybersecurity service providers, and formally designate critical information infrastructure, obligations not currently in statute.

The Senate passed amendments to the Cybercrimes Act 2015, with Senator Tavares-Finson declaring they confront 'real and growing dangers' of digital crime and are essential for building societal trust in digital systems. Amendments expand child-online protections and broaden prosecutorial tools for law enforcement.

Parliament's lower house passed amendments strengthening child-protection provisions, expanding law-enforcement investigative tools, and introducing liability for persons who knowingly allow their property to be used for cybercriminal activity, with penalties up to 15 years' imprisonment. Definitions were modernised to reflect digital-platform harm.

The Inter-American Development Bank-financed project (JA-L1093), co-funded with USAID, commenced a six-year programme to implement a national critical-infrastructure protection strategy, bolster JaCIRT's incident-response capacity, and integrate cybersecurity education from primary school through university accreditation standards.

The OIC began accepting registration applications from data controllers under the Data Protection Act 2020, completing the law's phased rollout and enabling active supervisory enforcement. Organisations processing personal data in Jamaica are now required to be registered.

The remaining provisions of the Data Protection Act 2020 commenced, making full compliance mandatory for all organisations handling personal data in Jamaica. All data controllers were required to register with the OIC by 30 November 2023, creating Jamaica's first enforceable data-security obligations tied to cybersecurity standards.

Jamaica's Financial Services Commission, the non-bank financial-sector regulator, suffered a ransomware attack in late 2023, one of the most prominent breaches of a public regulatory body. The incident underscored the absence of mandatory incident-reporting requirements and drove calls to accelerate cybersecurity legislation.

Minister Chang issued an official press release confirming a breach of the government's JamaicaEye platform and simultaneous attacks on at least one financial institution, and outlined active mitigation measures. This was the first high-profile public confirmation of a successful cyberattack against a national government platform.

Parliament enacted Jamaica's first comprehensive data-protection statute, establishing data-subject rights, controller and processor obligations, and the Office of the Information Commissioner as an independent supervisory authority. The Act broadly aligned Jamaica with GDPR-era international standards and introduced the first cybersecurity-adjacent data-handling obligations.

JaCIRT was declared fully equipped and operational in January 2016, having operated remotely since August 2015. Established with ITU and OAS/CICTE technical assistance, it became Jamaica's lead national agency for coordinating cyber-incident response, issuing government-wide threat advisories, and monitoring threats to government IT resources.

Parliament passed the Cybercrimes Act 2015 (Act No. 31 of 2015), repealing and replacing the 2010 Act. The new law added offences for computer-related fraud and forgery, malicious communications, and unauthorised disclosure of investigations, and mandated a legislative review by 2018. It remains Jamaica's principal cybercrime statute.

Jamaica launched its first National Cyber Security Strategy at the Jamaica Pegasus Hotel, co-hosted with the OAS, establishing five strategic pillars, Protect, Deter, Build, Partner, Govern. The strategy directed creation of JaCIRT, a national governance framework, and a legislative modernisation agenda, forming the policy backbone of all subsequent cybersecurity activity.

Jamaica enacted its inaugural cybercrime law, creating criminal sanctions for misuse of computer systems and electronic transactions. Though subsequently replaced by the 2015 Act, the 2010 legislation established Jamaica as one of the first Caribbean nations with a dedicated cybercrime framework and provided the prosecutorial foundation for early enforcement actions.