A quiz is not a data protection programme. We still published one.
In June 2025 Esirom shipped a free web app, the DPA Jamaica Compliance Challenge and Learning Center, so Jamaican business owners, managers and staff could learn the Act in plain language. Parliament had already passed the law. The duties were already in force. This page is the record of what that tool covered. It is not a live classroom, and it is not a filing with the Office of the Information Commissioner.
What the Act and the OIC have actually said
Parliament passed the Data Protection Act in 2020. JIS recorded 1 December 2023 as the day it took effect: the rules on how you collect, store, share and delete personal data. The OIC has been the regulator since 2021.
The Act names eight data protection standards. A data controller has to comply with them. You are a controller if you decide why and how personal data is processed. The eight, as the OIC lists them, are fair and lawful processing, specified purpose, adequacy, accuracy, retention, data-subject rights, security, and overseas transfers.
The OIC’s own FAQ is the source for the number people quote in boardrooms. For a body corporate, criminal prosecution can mean a fine not exceeding four percent of annual gross worldwide turnover. That is the Commissioner’s wording, not a slogan. The same FAQ names enforcement notices, offences, and civil compensation for damage. Full enforcement is still being built. The duties are not.
That is the record. What follows is ours.
What the tool was built to do
The app had five pieces.
A modular quiz on Key Definitions, the Eight Data Protection Standards, Data Subject Rights, and Enforcement. A comprehensive challenge that pulled questions from all of those. A learning centre with short summaries — what counts as personal data, what the standards require, how international transfers work. Progress tracking that saved a user’s best score per module. A motivational certificate of completion if you scored 90 percent or higher on the comprehensive challenge.
Motivational is the right word. A certificate from Esirom is not registration on the OIC portal, not a Data Protection Officer appointment, and not a data protection impact assessment. If you sat the challenge in 2025, keep the notes. Do not treat the PDF as a shield.
“Our goal is to empower Jamaican businesses, especially SMEs, with the knowledge they need to protect their customers’ data and their own operations,” said Skylar Hamilton, Marketing Strategist at Esirom, when the tool launched. “Compliance shouldn’t be a barrier to growth. We created this free tool to make understanding the DPA straightforward and even a little fun.”
That quote was published on this page in June 2025. It still describes the intent. Whether you can name a lawful basis for the list in the CRM is the test.
This resource is not a substitute for legal advice. It never was. It was a first pass at the vocabulary so a Kingston shop, a tourism brand, or a ministry contractor could ask a better question of counsel, of a vendor, or of us.
The public URL we advertised at launch is not a working destination. We are not sending you there. For the Act, the eight standards, registration status and the penalty language, use oic.gov.jm. For the operational map — processors, transfers, direct marketing, what to do while the register is paused — read Jamaica’s Data Protection Act Is Not a Someday IT Project.
What this means. The 2025 tool was a learning app. A certificate from Esirom is not registration, not a Data Protection Officer, and not legal advice.
What to do. For the Act, the eight standards, and penalties, use oic.gov.jm. For the operational map, read the field guide.
Last fact-checked 21 August 2026.
