Data Protection Act, 2020, comprehensive data-protection regime and automated decision-taking
Data Protection Act, 2020 (Act 7 of 2020)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Register with the Office of the Information Commissioner as a data controller before processing personal data, and have a lawful basis for the processing under the Act's data protection standards.
- Do not base a decision that significantly affects a person solely on automated processing, including profiling, of their personal data used to evaluate matters such as performance, creditworthiness, reliability, or conduct, once the person has given notice objecting.
- Meet the heightened conditions in section 24 before processing sensitive personal data, including genetic or biometric data.
- Report a contravention of the data protection standards, or a security breach affecting personal data, to the Information Commissioner within 72 hours of becoming aware of it.
- Do not transfer personal data outside Jamaica unless the receiving country ensures an adequate level of protection, or a listed exception such as the data subject's consent applies.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Knowingly or recklessly obtaining, disclosing, or procuring the disclosure of personal data without the data controller's consent (s. 61) is liable on summary conviction to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years, or on indictment to an unlimited fine or imprisonment not exceeding ten years (s. 61(10)). Processing personal data without registering as a data controller (s. 15, s. 18) is liable on summary conviction to a fine not exceeding JMD 2,000,000 or imprisonment not exceeding six months (s. 18(3)).
Penalty structure
Applies to summary conviction before a Parish Court for unlawfully obtaining or disclosing personal data without the data controller's consent (s. 61(1), (10)(a)). On indictment before a Circuit Court the fine is unspecified (unlimited) and imprisonment may reach ten years (s. 61(10)(b)).
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- JMD
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Office of the Information Commissioner
What it reaches
Obligation class
Consent, Data subject rights, Transfer, Breach notice, Disclosure, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act binds the Crown and any data controller, whether a person or a public authority, that processes personal data in Jamaica or, from outside Jamaica, targets data subjects who are in Jamaica; section 15 prohibits processing personal data without registering with the Information Commissioner.
Section 12 entitles a data subject to require that no decision significantly affecting them be based solely on automated processing, including profiling, of personal data used to evaluate matters such as their performance at work, creditworthiness, reliability, or conduct, and lets the Commissioner order a fresh decision where a data controller fails to comply.
Section 21(3) requires a data controller to report a contravention of the data protection standards or a security breach affecting personal data to the Commissioner within 72 hours of becoming aware of it. Section 24 imposes heightened conditions on processing sensitive personal data, a category that includes genetic and biometric data.
Section 31 bars transferring personal data outside Jamaica unless the receiving state or territory ensures an adequate level of protection, subject to exceptions including the data subject's consent.
Section 61 makes it an offence to knowingly or recklessly obtain, disclose, or procure the disclosure of personal data without the data controller's consent, and section 69 entitles an individual who suffers damage, or distress in specified circumstances, by reason of a data controller's contravention of the Act to compensation from that data controller.
When LexLint raises it
crawls_webtrains_modelshigh_risk_decisionsprocesses_biometrics
Read the law
Text of the Data Protection Act, 2020 as published by the Houses of Parliament of Jamaica