GHS Data Security Limited

Blog / Compliance

How to register with the Information Commissioner, step by step

· GHS Data Security Limited

Most organisations I sit with want to do the right thing. They simply do not know where the starting line is. For data protection in Jamaica, the starting line is registration with the Office of the Information Commissioner. Until that is done, every other good intention sits on sand, because processing personal data without being registered is an offence on its own.

Before you touch the form

Registration asks you to describe what personal data you handle and why. That is much easier when you already know the answer, so spend an afternoon writing down four things.

  • What you collect. Customer names, staff records, closed-circuit television footage, job applications, health details for insurance, and so on.
  • Why you collect it. One clear purpose per type of data. "Because we always have" is not a purpose.
  • Where it lives. The accounting system, the shared drive, the receptionist's notebook, the manager's phone, the cloud backup.
  • Who sees it, inside and outside. Staff roles, your accountant, your software supplier, anyone overseas.
Tip: do this with the people who actually handle the data, not only with management. The notebook on the front desk never appears on the official system list.

Naming the responsible person

You will be asked who is accountable. Give a name and a role, not a department. If your organisation must have a data protection officer, or you have chosen to appoint one, that is the person. A virtual officer works here too, as long as they are genuinely reachable.

The mistakes that cost weeks

  1. Vague purposes. "Business operations" tells the Commissioner nothing. "Processing orders and handling warranty claims" does.
  2. Forgetting the small systems. The appointment book, the WhatsApp group, the sign-in sheet at the gate. They are all personal data.
  3. Silence on overseas transfers. If your email, accounting or backup sits on servers abroad, say so and be ready to explain the safeguards.
  4. Treating it as a one-off. When your systems or purposes change, your entry has to change with them.

After you are registered

Registration proves you have told the regulator what you do. It does not prove you are doing it safely. The work that follows is the work that protects you: policies people have actually read, access limits that match roles, a retention schedule, a breach plan, and training that is not a once-a-year slideshow.

If you would rather not do the paperwork alone, our registration service prepares your record of processing and submits it for you, and the Gap Analysis is free before you commit to anything.

This article is general guidance, not legal advice.

Keep reading