JamaicaData Protection Act, 2020, conditions for processing sensitive personal data
Data Protection Act, 2020 (Act 7 of 2020), ss. 2(1), 24
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not process genetic data, biometric data, health data or any other sensitive personal data unless at least one condition in section 24 is met in addition to a condition in section 23.
- Treat a photograph or other facial image, finger print, palm print, iris scan, retina scan, vein pattern, gait, signature, keystroke pattern or voice that allows unique identification of an individual as biometric data, and therefore as sensitive personal data.
- Obtain the data subject's consent in writing before processing their sensitive personal data on the consent condition, and stop processing on that condition once the consent is withdrawn.
- Do not process sensitive personal data for medical purposes unless you are a health professional or a person who owes an equivalent duty of confidentiality.
What it reaches
Obligation class
Biometric, Consent
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Sensitive personal data is personal data consisting of genetic data or biometric data, filiation or racial or ethnic origin, political opinions or philosophical, religious or similar beliefs, trade union membership, physical or mental health or condition, sex life, or an alleged offence by the data subject and any proceedings for it.
Biometric data is any information relating to the physical, physiological or behavioural characteristics of an individual which allows for the unique identification of the individual, and the definition names the photograph or other facial image, finger print, palm print, iris scan, retina scan, blood type, height, vein pattern and eye colour among the physical characteristics and gait, signature, keystrokes and voice among the behavioural ones.
Section 24 permits processing sensitive personal data only where at least one condition in that section is met in addition to a condition in section 23, and the first of those conditions is the data subject's consent in writing.
The other conditions include an employment or social security right or obligation, protection of vital interests where consent cannot be obtained, legitimate activity of a not-for-profit body acting for its members with appropriate safeguards, data the data subject has deliberately made public, legal proceedings or advice, the administration of justice, fraud prevention through an anti-fraud organisation, medical purposes undertaken by a health professional or a person owing an equivalent duty of confidentiality, and equality of opportunity monitoring by racial or ethnic origin.
A data subject may at any time withdraw consent to the processing of sensitive personal data in respect of that data subject. The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
Read the law
Text of the Data Protection Act, 2020 as published by the Houses of Parliament of Jamaica
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.