Data Protection Act, 2020, rights of data subjects and automated decision-taking

Data Protection Act, 2020 (Act 7 of 2020), ss. 5-13

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Answer a data subject's written access request promptly and in any event before the end of 30 days, saying free of charge whether you process their personal data and describing that data, the purposes of the processing and the recipients.
Give the data subject, on payment of the prescribed fee, their personal data in an intelligible form together with any information you hold as to its source, or, where technically feasible, transmit it to another data controller in a structured, commonly used and machine-readable format.
Explain to the data subject, on payment of the prescribed fee, the logic involved in automatic processing that is or is likely to be the sole basis for a decision significantly affecting them.
Identify in writing, within 30 days of the request, the provision you rely on where you refuse to disclose personal data to the data subject.
Stop basing a decision that significantly affects a person solely on the automatic processing of their personal data used to evaluate matters such as performance at work, creditworthiness, reliability or conduct, once that person gives you written notice.
Inform a person as soon as is reasonably practicable where you took such a decision without having received that notice, and give them a written statement within 30 days of the steps you will take where they require you to reconsider it.
Give a written statement within 21 days to a person who requires you to cease processing that causes substantial unwarranted damage or distress, saying whether you will comply and, where you will not, why.
Determine within 30 days of a rectification request whether the personal data is inaccurate, correct it where it is, and give notice to the individual and to everyone the data was disclosed to in the preceding twelve months.
Do not process personal data for direct marketing unless the data subject consents or is your customer, and do not approach the same data subject for that consent more than once.
Carry in every direct marketing communication the identity of the sender and an address or other contact details the recipient can use to ask that the communication cease.

What it reaches

Obligation class

Data subject rights, Consent, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

On a written request a data subject is entitled to be told free of charge whether personal data of which they are the data subject is being processed, and to be given a description of that data, of the purposes of the processing and of the recipients or classes of recipients to whom it may be disclosed.

On payment of the prescribed fee the data subject may also have the data communicated in an intelligible form with any available information as to its source, or, where technically feasible, transmitted to another data controller in a structured, commonly used and machine-readable format, and may be informed of the logic involved in automatic processing that has constituted or is likely to constitute the sole basis for a decision significantly affecting them.

A data controller shall comply with a request under section 6 promptly and, in any event, before the end of the period of thirty days, and must inform the individual in writing of a refusal and the provision relied on within thirty days after receiving the request.

Section 12 entitles an individual at any time, by notice in writing, to require a data controller to ensure that no decision significantly affecting them is based solely on the processing by automatic means of personal data used to evaluate matters such as their performance at work, creditworthiness, reliability or conduct.

Where such a decision is taken without that notice the data controller must inform the individual as soon as is reasonably practicable, the individual may then require reconsideration or a fresh decision within thirty days, and the data controller must give a written statement of the steps it intends to take within thirty days of that notice.

An individual may require a data controller to cease or not to begin processing that causes substantial unwarranted damage or distress, or that rests on incomplete, irrelevant, unlawful or over-retained data, and the data controller must answer in writing within twenty-one days.

Section 13 requires a data controller that receives a rectification request to determine within thirty days whether a rectification is required, to amend, block, erase or destroy the data where it is, and to give notice of the rectification to the individual and, so far as reasonably practicable, to everyone the data was disclosed to in the preceding twelve months.

Section 10 bars processing personal data for direct marketing unless the data subject consents or is a customer of the data controller who was given a free and informal opportunity to object at collection and in each marketing communication. The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.

When LexLint raises it

high_risk_decisions
automated_outreach
deploys_chatbot
crawls_web
trains_models

Read the law

Text of the Data Protection Act, 2020 as published by the Houses of Parliament of Jamaica

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app