News

The Data Protection Law (DPL) came into force on 30 September 2019.

The long-awaited law was enacted in 2017 following an intensive, multi-year drafting exercise with broad representation from the public and private sectors. The DPL is modeled on data protection legislation in the European Union, and is centered around eight data protection principles.

The DPL defines the statutory framework for use of personal information by businesses, organizations and public authorities. It also grants rights to individuals in relation to their data.

The new law places a number of obligations on data controllers, including a duty to inform individuals how their data is being used, ensure that data is accurate and relevant to the purpose for which it is used, and is retained only for as long as necessary. Data controllers are also required to notify the Ombudsman and the affected individuals of serious data breaches.

Building on the fundamental right to private and family life in the Cayman Islands Bill of Rights, the DPL grants individuals a number of important rights, including the right to request access to their data, ask for rectification of inaccurate data, and stop direct marketing.

The Office of the Ombudsman is tasked with oversight and enforcement, and individuals have the right to complain to the Ombudsman if they believe their data is not being processed in accordance with the new law.

More information including detailed guidance is available on the website of the Office of the Ombudsman: https://ombudsman.ky/data-protection