The Data Protection Act, in plain language.

Who the Act covers

If your organisation decides why and how personal information is collected and used, the Act calls you a data controller. Personal data is anything that identifies a living person: a name with a phone number, a customer account, a staff file, a photograph, a vehicle number plate tied to a driver. A church, a credit union, a school, a hardware store and a government agency are all data controllers.

If you handle personal data on someone else's instructions, say a payroll bureau or a cloud provider, you are a data processor, and the controller must have a written agreement with you.

The eight standards, in everyday words

1. Be fair and lawful. People should know you are collecting their information and why.
2. Stick to the purpose. Data collected to deliver an order is not data for a marketing blast.
3. Collect only what you need. If the form asks for a date of birth, be ready to say why.
4. Keep it accurate. Wrong information causes real harm, and correcting it is a right.
5. Do not keep it forever. Decide how long each type of record lives, then delete it.
6. Respect people's rights. They can ask what you hold, ask you to fix it, and ask you to stop.
7. Keep it secure. Locks, passwords, access limits, backups and trained staff.
8. Be careful sending it overseas. Check the protection on the other end before data leaves Jamaica.

Registration

Data controllers register with the Office of the Information Commissioner, describing what personal data they handle and why. Processing without registering is an offence on its own. Registration is not a one-off form in a drawer either: when your systems or purposes change, your entry changes too.

The 72 hour rule

If personal data is lost, stolen or exposed, you report it to the Commissioner within 72 hours of becoming aware, and you tell the people affected. Three days sounds generous until you are living it. The organisations that cope are the ones that wrote the plan before anything happened.

The annual impact assessment

Controllers submit a data protection impact assessment to the Commissioner within the first 90 days of each calendar year. It is a structured look at what you hold, what could go wrong and what you are doing about it. Done properly, it is also the most useful management report you will read all year.

Where to start this week

1. Write down every place personal data lives: systems, spreadsheets, paper files, phones.
2. Check whether you are registered, and whether the entry still matches reality.
3. Decide who is responsible for data protection by name, not by committee.
4. Write the breach plan while nothing is on fire.
5. Train the people who touch the data every day.

This guide is general information, not legal advice. For the text of the law itself, read the Data Protection Act, 2020 and the guidance published by the Office of the Information Commissioner.