Data Protection Act (2021 Revision) - Guide for Data Subjects

Summary

This is a plain-language guide published by the Cayman Islands Office of the Ombudsman to help individuals (data subjects) understand their rights under the Data Protection Act (2021 Revision). It explains core data protection concepts and principles, then sets out the specific rights individuals can exercise against organizations (data controllers) that hold their personal data.

• Eight data protection principles: Fair and lawful processing, purpose limitation, data minimization, data accuracy, storage limitation, respect for individual rights, security/confidentiality, and restrictions on international transfers of personal data outside the Cayman Islands.
• Right to be informed: Individuals must be told the identity of the data controller and the purposes of processing, typically via a privacy notice provided at or near the point of data collection.
• Right to access: Individuals can request a copy of their personal data plus related information (source, recipients, transfers, security measures); the controller must respond within 30 days of a written request, subject to identity verification.
• Right to correction: Individuals can have inaccurate personal data corrected.
• Rights on automated decisions: Individuals can object to decisions made solely by automated means that significantly affect them and request human reconsideration, subject to contract-related exceptions.
• Right to stop processing: Individuals can require a controller to stop or not begin processing, subject to exceptions such as contractual necessity or legal obligation.
• Right to stop direct marketing: Individuals have an absolute right to opt out of direct marketing by written request to the controller.
• Right to compensation: Individuals may seek court-ordered compensation for damage caused by a controller's breach of the DPA.
• Right to complain to the Ombudsman: Individuals may lodge complaints with the Office of the Ombudsman, which can investigate and, if upheld, order corrective action or impose a monetary penalty of up to CI$250,000 on the organization.

The guide is informational and directed at individuals rather than imposing new obligations itself, but it summarizes statutory obligations that data controllers (public and private organizations handling personal data) must meet under the DPA, and directs readers to the Ombudsman's separate guidance for organizations for more detail.

Key obligations

• Data controllers must provide individuals with a privacy notice identifying the organization and the purposes of processing, generally at the point personal data is collected.
• Data controllers must provide a copy of an individual's personal data, along with related information (source, recipients, international transfers, security measures), within 30 days of a written access request.
• Data controllers must correct inaccurate personal data upon request.
• Data controllers must stop processing personal data upon a valid request unless a recognized exception applies (e.g. contractual necessity, legal obligation, vital interests).
• Data controllers must cease direct marketing to an individual upon written request.
• Data controllers must not transfer personal data outside the Cayman Islands unless the destination provides adequate protection or safeguards.
• Organizations must handle complaints and cooperate with Ombudsman investigations, and may be subject to enforcement orders or monetary penalties up to CI$250,000 for breaches.

Applies to

data controllers, public authorities, private businesses/organizations processing personal data, data subjects (individuals)

Deadlines

• 30 days: Data controllers must provide a copy of requested personal data within 30 days of a data subject's written access request (time limit suspended pending identity verification).