Data Protection Law comes into force

Legislation geared towards the protection of personal data and how it is used in the Cayman Islands took effect this week.

The Ombudman’s Office, the entity charged with overseeing the Data Protection Law, announced Tuesday that the law came into force on 30 Sept.

“The long-awaited law was enacted in 2017 following an intensive, multi-year drafting exercise with broad representation from the public and private sectors. The DPL is modelled on data protection legislation in the European Union and is centred around eight data protection principles,” a statement from the Ombudsman’s Office read.

The law was originally scheduled to be implemented on 1 Jan. this year. However, government pushed the start date back by nine months, following representations by the financial services industry.

The law regulates how businesses and government agencies must handle all personal data and it provides a framework of rights and duties designed to give individuals greater control over their personal data. This means individuals will have the right to request and access their personal data that is held by an organisation, and data controllers have about 30 days to comply.

“The new law places a number of obligations on data controllers, including a duty to inform individuals how their data is being used, ensure that data is accurate and relevant to the purpose for which it is used, and is retained only for as long as necessary.

“Data controllers are also required to notify the Ombudsman and the affected individuals of serious data breaches,” the statement explained.

In addition to the right to request access to their data, the Ombudsman’s Office said, individuals can also ask for rectification of inaccurate data, and to stop direct marketing.

The Office of the Ombudsman added, “Individuals have the right to complain to the Ombudsman if they believe their data is not being processed in accordance with the new law.”

More information, including detailed guidance, is available on the website of the Office of the Ombudsman: https://ombudsman.ky/data-protection.