Data protection & privacy laws in Jamaica (2026)

The Data Protection Act, 2020 (No. 7 of 2020) was passed by Jamaica's Parliament and received assent in June 2020. Initial sections commenced in December 2021; the Act came fully into force on 1 December 2023 following a phased transition period.

The Office of the Information Commissioner (OIC) is Jamaica's independent data protection regulator. It maintains a public register of data controllers, receives and investigates complaints, can conduct audits and own-initiative investigations, and issues enforcement notices. The first Information Commissioner, Celia Barclay, was appointed on 1 December 2021.

Data controllers must comply with eight statutory standards covering: lawful and fair processing; informed and freely given consent; transparency with data subjects; data minimisation and retention limits; restrictions on cross-border transfers without adequate protection; upholding data subject rights; implementing appropriate technical and organisational security measures; and prohibition on processing for illegal or immoral purposes.

Individuals hold rights to access their personal data, request rectification (controllers must act within 30 days and notify downstream recipients), and opt out of automated decision-making. Data subjects may bring civil claims for damages where personal data is mishandled.

All data controllers are required to register with the OIC before processing personal data. Registration commenced 1 June 2024. In early 2026 the OIC temporarily paused registrations to upgrade its online portal to include e-commerce payment functionality; as of January 2026 no formal enforcement action has been taken against any controller for failure to register.

Maximum penalties under the Act include fines of up to 5 million JMD (~USD 32,000), up to 4% of annual gross revenue, and imprisonment of up to ten years for criminal offences. However, as of early 2026 the OIC's full investigative and enforcement powers have not yet been brought into effect by ministerial order, meaning proactive regulatory enforcement actions have not commenced.