What Is Data Protection Act, 2020 (Act No. 7 of 2020)?
Jamaica's principal privacy statute is the Data Protection Act, 2020 (Act No. 7 of 2020). Its commencement is staged by ministerial Gazette notice. The Office of the Information Commissioner became operational on 1 December 2021, while broad Part II rights and Part V exceptions commenced on 1 December 2023. The Act is not fully operative. Section 18, specified parts of §21, Part VI (§§44-55), §62, §70, and the Third and Fifth Schedules remained uncommenced in the dated research record. In June 2026, the Jamaican Government stated that enforcement provisions would be activated in the future and that Jamaica had not yet fully enforced the Act. Part II provides access, information, consent and withdrawal, direct-marketing, prevention-of-processing, automated-decision, and rectification rights. Jamaica should not be described as having an unconditional GDPR-style deletion right: erasure appears within rectification where needed to correct an inaccuracy. No Jamaica-specific data-broker complaint or public-record deletion route was located.
At a glance
- Full name
- Data Protection Act, 2020 (Act No. 7 of 2020)
- Short code
- Data Protection Act 2020
- Jurisdiction
- Jamaica
- Enacted
- 2020
- Last major update
- Staged commencement: core institutional provisions commenced 1 December 2021, broad Part II and Part V provisions commenced 1 December 2023, and the 2024 Data Protection Regulations now supply request and appeal procedures; Part VI enforcement machinery and §70 appeals remained uncommenced in the 9 October 2026 review
- Regulator
- Office of the Information Commissioner (OIC)
- Private right of action
- Limited
- Statutory citation
- Data Protection Act, 2020 (Act No. 7 of 2020)
Scope, who Data Protection Act 2020 covers
Protected data
Data subject rights
Representation by a parent, guardian, relative, legal representative, or written delegate under §5
Access and information under §6, ordinarily within 30 days, with a possible additional 45 days for complex requests under Regulation 4
Consent and withdrawal under §9
Direct-marketing rights under §10
Prevention of processing where reasonable in the circumstances under §11
Automated-decision challenge within 30 days, with the controller required to respond within 30 days under §12
Rectification under §13, with a 30-day determination period and notification of prior recipients where reasonably practicable
Erasure only within rectification where needed to correct an inaccuracy; no unconditional GDPR-style deletion right was identified
Right to complain to the OIC after using the controller-facing request route; no statutory exhaustion requirement was located
Notable features
The defining currentness issue is staged commencement. Part II rights and Part V exceptions are in force, but the principal Part VI enforcement machinery and §70 appeal provision remain uncommenced. The Act also uses a narrower rectification-based treatment of erasure than an unconditional GDPR-style deletion right.
Enforcement & penalties
Regulator: Office of the Information Commissioner (OIC)
Penalties: For §63, requiring a relevant record as a condition of goods or services may attract up to J$2 million or two years imprisonment on summary conviction, or a fine or up to five years imprisonment on indictment. Knowing or reckless confidential-information disclosure under §66(3) may attract up to J$2 million or two years on summary conviction, or a fine or up to ten years on indictment. Section 68 provides a body-corporate court penalty of up to 4% of annual gross worldwide turnover. The general enforcement-notice and fixed-penalty machinery in Part VI remains uncommenced, so §68 is not an operative general administrative fine for every breach.
Private right of action: Controller requests, OIC complaints, and an uncommenced statutory appeal route are the identified mechanisms; no general private damages action was identified.
Relevance to data brokers
No Jamaica-specific data-broker complaint or deletion route was located. The OIC publishes a current data-subject complaint form with categories for missing registration, consent or withdrawn-consent processing, access, rectification, ceasing processing, automated decision-making, direct marketing, and other DPA issues. That is a general regulator complaint route, not a dedicated broker or public-record deletion procedure. Section 38’s exemption for information made public by or under an enactment is a disclosure and rectification carve-out, not a dedicated public-record deletion procedure.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Jamaica’s Data Protection Act fully in force?+
No. Part II rights and Part V exceptions are in force, but §18, specified parts of §21, Part VI (§§44-55), §62, §70, and the Third and Fifth Schedules remained uncommenced in the 9 October 2026 review.
Does Jamaica provide an unconditional right to delete personal data?+
No unconditional GDPR-style deletion right was identified. Erasure appears within rectification where needed to correct an inaccuracy, alongside prevention-of-processing and storage-limitation provisions.
Does Jamaica have a dedicated data-broker deletion route?+
No Jamaica-specific data-broker complaint or deletion route was located. The OIC does provide a general data-subject complaint form covering access, rectification, ceasing processing, automated decisions, direct marketing, and other DPA issues, but it is not a dedicated broker or public-record deletion route.
Official sources & citations
Other international privacy regimes
Data Protection Act 2020 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: