Data Protection Act (2021 Revision)

Summary

This is the consolidated text of the Cayman Islands Data Protection Act, the Islands' primary data protection law, administered and enforced by the Ombudsman. It sets out the data protection principles that govern how personal data must be collected and processed, gives data subjects enforceable rights over their data, and gives the Ombudsman investigative and enforcement powers including monetary penalties.

• Scope: Applies to any data controller established in the Cayman Islands whose personal data processing occurs in that context, and to data controllers established elsewhere but processing personal data in the Islands (other than data merely transiting through).
• Local representative: A data controller not established in the Islands but processing personal data there must nominate a local representative who bears all obligations under the Act as if it were the data controller itself.
• Data protection principles: Data controllers must comply with, and ensure compliance with, the data protection principles (Schedule 1), including lawful processing conditions in Schedules 2 and 3 and restrictions on international transfers unless a Schedule 4 exception applies.
• Data subject rights: Individuals have rights of access to their personal data, rights to stop processing (including for direct marketing), rights regarding automated decision-making, rights to rectification, blocking, erasure or destruction, and a right to compensation for non-compliance.
• Breach and restricted processing: The Act addresses personal data breaches and allows the Ombudsman to make preliminary determinations on restricted processing.
• Exemptions: Specific exemptions apply for national security, crime and government fees, health/education/social work, journalism/literature/art, research/statistics, legal proceedings, corporate finance, negotiations, legal professional privilege and trusts, and others set by regulation.
• Ombudsman enforcement: The Ombudsman can receive complaints, issue information orders and enforcement orders, enter and search premises under warrant, and impose monetary penalty orders for non-compliance, with a right of judicial review for affected parties.
• Offences: Unlawful obtaining or disclosure of personal data, and failure to comply with warrants or orders, are offences under the Act.

The document is a Law Revision Act consolidation reflecting amendments up to 2021; it does not itself introduce new commencement or transition deadlines beyond the original 2019 commencement of the underlying law.

Key obligations

• Data controllers must comply with the data protection principles in Schedule 1 for all personal data they process, and ensure compliance by those processing on their behalf.
• A data controller not established in the Cayman Islands but processing personal data there must nominate a local representative who assumes all obligations under the Act.
• Data controllers must respond to data subject requests for access to personal data in accordance with sections 8 and 9.
• Data controllers must cease processing on a valid data subject request under sections 10 and 11, including for direct marketing purposes.
• Data controllers must comply with rectification, blocking, erasure or destruction requests under section 14.
• Data controllers and others must comply with information orders and enforcement orders issued by the Ombudsman, and failure to do so is an offence.
• Personal data transfers outside the Islands must satisfy an exception in Schedule 4 or otherwise comply with the eighth data protection principle.
• Consent relied upon for processing must meet the conditions of consent set out in Schedule 5, including the right of withdrawal.

Applies to

data controllers, data processors, businesses processing personal data, public authorities, data subjects