Jamaica's Data Protection Act moved from paper to practice across 2024. The Office of the Information Commissioner began processing data controller applications once the grace period expired in June, and government ministries plus high-risk processors were told to register by 1 June. Roughly 600 controllers completed registration in the first week alone.
Registration is the visible part. The harder part is what registration implies: a lawful basis for each processing activity, a records-of-processing inventory, breach notification procedures, a named Data Protection Officer and evidence that staff have been trained. Regulators do not ask for those on the registration form — they ask for them when something goes wrong.
The pattern we see in Jamaican engagements is that registration gets done in a week and the underlying programme takes three to six months. Organisations that treated the deadline as the finish line are the ones now discovering gaps in their retention schedules and third-party contracts.
For a locally focused organisation, a Jamaican specialist usually handles this faster and cheaper than a network firm. Where an overseas parent is involved and the privacy programme has to satisfy group policy as well as the Act, the Big Four privacy practices earn their fee.