Jamaica’s Data Protection Act has applied since 1 December 2023. Full enforcement is still being built: Information Commissioner Celia Barclay told Parliament’s Public Accounts Committee in late July that full enforcement is not expected until 2028. The register is paused. The duties are not.
Parliament passed the Act in 2020. JIS recorded 1 December 2023 as the day it took effect: the rules on how you collect, store, share and delete personal data. The Office of the Information Commissioner has been the regulator since 2021. What is still unfinished is the Office’s capacity to police that.
In June, Minister Andrew Wheatley told the House the enforcement provisions have not been fully activated. He was blunt. “We have the law. What we have not yet done is fully enforce it.” He pointed at an interim OIC structure, staffing below what the mandate needs, and officers without the technical training compliance work demands. The Government, he said, has now approved the Office’s full requested budget and stood up a Data Protection Working Group so that work can start.
Barclay told the Committee the Office is still staffing up. The job also needs ICT, and arrangements with the police, the courts and mediators. Registration of data controllers is paused on the OIC’s own homepage, and has been since 1 December 2025, while the portal is upgraded. In March the OIC said it will not impose liability for processing without registration while that platform is offline. Barclay told the Committee that organisations handling personal data remain obligated to comply.
The rum brand’s CRM, the festival ticket list, the hotel booking engine, and the ministry WhatsApp blast are still personal data. They have been covered since December 2023. Jamaicans are being told, by JIS and the OIC, that this law exists to protect the data they hand over. If the insertion order never names who is the controller, you find that out in a complaint.
The duties that already apply
The Act names eight data protection standards. A data controller has to comply with them. You are a controller if you decide why and how personal data is processed. A processor is anyone other than your employee who processes that data on your instructions. Most agencies sit in both chairs: controller of their own staff and leads; processor or joint controller when a client hands over a customer file for ads, WhatsApp or email.
Processing needs at least one condition from section 23 of the Act. Consent is one. Others include performance of a contract, a non-contractual legal obligation, vital interests, public functions, legitimate interests that do not override the person, and data the person has already published. Sensitive data needs a further condition from section 24, usually written consent. The OIC’s standard on fairness is clear on what consent has to be: informed, specific, unequivocal, freely given, and capable of being withdrawn. You collect for a specified, lawful purpose, and only what you need.
If a vendor processes personal data for you, choose one that can actually secure it. The arrangement has to be a contract made or evidenced in writing. The processor acts only on your instructions and takes security obligations equivalent to yours. That covers Meta, Google, Mailchimp, Salesforce, WhatsApp Business platforms and cloud CRMs.
Personal data shall not be transferred outside Jamaica unless the receiving state or territory ensures an adequate level of protection. Most ad and CRM stacks live outside Jamaica. The Act lists cases where that bar does not apply, including the person’s consent, transfers necessary for a contract with them, and transfers on terms the Commissioner has approved as adequate safeguards.
Section 10 covers direct marketing. You do not process someone’s data for direct marketing unless they consent, or they are already your customer and you meet the customer conditions. The OIC’s own example: a phone number collected to deliver a service is not a licence to sell or disclose it for third-party marketing.
Controllers must be on the OIC register when the portal is taking applications. Watch oic.gov.jm for it to reopen. Barclay told Parliament she is aiming for late September. Prepare the particulars now: who you are, what you process, purposes, recipients, overseas destinations.
Public authorities, anyone handling sensitive data or criminal-conviction data, and anyone processing personal data on a large scale must appoint a qualified, independent Data Protection Officer. Unless the Commissioner says otherwise, controllers submit a data protection impact assessment covering all personal data in their custody within ninety days after each calendar year. Security breaches that affect or may affect personal data must be reported to the Commissioner, and to the people affected, within seventy-two hours of becoming aware.
The Act still provides for enforcement notices, criminal offences, civil compensation, and, for a body corporate, a fine not exceeding four percent of annual gross worldwide turnover. Wheatley and Barclay have both said those enforcement provisions are still being stood up. A civil claim does not wait for the Office to finish hiring.
What this means. Client data in ads, CRM, WhatsApp and booking engines has been covered since December 2023. Enforcement catching up toward 2028 is a reason to get the files in order.
What to do. List every place personal data lives — website forms, CRM, ad accounts, WhatsApp, email tools, contest entries, HR — and write the purpose and section 23 condition for each; name your processors in writing, flag every flow that leaves Jamaica, and check direct marketing so customers are separate from cold lists. If you are a public authority, process sensitive data, or process on a large scale, appoint an independent Data Protection Officer and start the impact-assessment file owed after year-end.
See also Esirom’s 2025 free interactive tool for learning the Act in plain language.
Last fact-checked 21 August 2026.
