Jamaica’s Data Protection Act, 2020 applies to organisations that collect and use personal data — customer records, employee files, patient information, even a mailing list. Much of what the Act expects comes down to how your systems are run. This checklist covers the technical side; for legal interpretation, work with your legal adviser.
1. Know what personal data you hold, and where
Make an inventory: which systems hold personal data (email, accounting, CRM, shared drives, laptops, phones), who can access each, and how long you keep it. You cannot protect data you do not know you have.
2. Limit who can see it
Give staff access only to the data their role needs, remove accounts promptly when people leave, and review permissions regularly. Over-shared folders are one of the most common causes of data exposure.
3. Turn on multi-factor authentication everywhere
Stolen passwords are the easiest way into a business. Multi-factor authentication on email, remote access, and cloud applications blocks the vast majority of account-takeover attempts.
4. Encrypt laptops, phones, and backups
A lost laptop with an encrypted disk is an inconvenience; an unencrypted one can be a reportable breach. Encrypt devices and backups, and make sure company phones can be wiped remotely.
5. Patch, protect, and monitor
Keep operating systems and applications updated, run managed endpoint protection on every device, and monitor for unusual activity so problems are caught early rather than discovered months later.
6. Be ready for an incident
Decide in advance how you would detect a breach, who investigates, how you contain it, and how you notify the people affected and the Information Commissioner where the Act requires it. A written plan turns a crisis into a procedure.
7. Keep records of what you do
Document your controls, reviews, and training. Being able to show what you have in place matters to customers, partners, and regulators alike.
We implement and document these controls for businesses across Jamaica — access control, multi-factor authentication, encryption, patching, backups, and incident readiness — so you can answer data protection questions with confidence.
Related service: IT Solutions — Managed IT, backups, disaster recovery, and security.