Jurisdiction dossier

Jamaica: AI regulation & deadlines

Jamaica does not follow the GDPR art. 22 pattern its Caribbean neighbours use. Section 12 of the Data Protection Act, 2020 (Act 7 of 2020) is drafted on the United Kingdom's Data Protection Act 1998 s. 12 and is a notice-based right rather than a standing prohibition. Section 12(1) fixes the trigger: the section «applies to a decision, other than an exempt decision, taken by or on behalf of a data controller and which significantly affects a data subject». Section 12(2) then gives the individual the entitlement «at any time, by notice in writing to the data controller, to require the data controller to ensure that no decision to which this section applies is based solely on the processing, by automatic means, of personal data in respect of the data subject for the purpose of evaluating matters relating to the data subject (for example, the individual's performance at work, creditworthiness, reliability, or conduct)». Nothing bars the decision until that notice is served. What lifts Jamaica above the 1998 model is s. 12(3), which bites where no notice has been served. Where a controller who has not received a s. 12(2) notice takes a decision to which the section applies, the controller «shall, as soon as is reasonably practicable, inform the individual that the decision was made on the basis described in subsection (2)», and the individual is then entitled, within thirty days of receiving that information, to require the controller by written notice «to reconsider the decision or make a new decision otherwise than on that basis». Section 12(4) gives the controller thirty days from that notice to supply a written statement of the steps it intends to take. This is an unconditional, controller-side disclosure duty attaching to every solely-automated significant decision — the Jamaican Act volunteers the fact of automation, which the Zambian and Mauritian statutes do not. The exemptions sit at s. 12(7)-(8) and are narrower than GDPR art. 22(2) because both limbs must be met. An «exempt decision» is one authorised or required by or under any enactment, or made in the course of steps taken to consider entering into or to perform a contract with the data subject — and, cumulatively, either the effect of the decision is to grant a request of the data subject, or steps have been taken to safeguard the data subject's legitimate interest, «for example, by allowing the data subject to make representations». There is no consent limb at all: consent is not a route out of s. 12 in Jamaica. The logic limb is separate and reactive. Section 6(2)(d) entitles an individual, where processing by automatic means of his personal data «is for the purpose of evaluating matters relating to that individual (such as, for example, the individual's performance at work, creditworthiness, reliability, or conduct)» and «has constituted or is likely to constitute the sole basis for any decision significantly affecting the individual», «to be informed by the data controller, upon payment of the prescribed fee, of the logic involved in that decision-taking». Note the fee: Jamaica is one of the few jurisdictions on this tracker where the explanation right is expressly chargeable. Section 6(7)(a) lets the Commissioner require the logic information to be produced for inspection when adjudicating a s. 6(6) application, but s. 6(7)(b) bars disclosure to the applicant pending determination in the applicant's favour. Commencement is phased and the phasing matters. Section 1(1) provides that the Act «shall come into operation on a day appointed by the Minister by notice published in the Gazette, and different days may be appointed in respect of different provisions of this Act». The first Appointed Day Notice — the Data Protection Act, 2020 (Sections 2, 4, 56, 57, 60, 66, 74 and 77 and First Schedule) (Appointed Day) Notice, 2021, No. 221, Jamaica Gazette Supplement Vol. CXLIV No. 160, dated 30 November 2021 and read in full here — appointed 1 December 2021 for ss. 2, 4, 56, 57, 60, 66, 74 and 77 and the First Schedule only. Those are the Office of the Information Commissioner's own constitutive provisions. **Section 12 was not among them**, so the automated-decision right was not in force in 2021, and any source dating this obligation to 1 December 2021 is reading the wrong notice. The operative date is the second notice. Section 76(1) requires a data controller to secure full compliance «on or before the expiration of a period of two years from the earliest day appointed under section 1(1)», which runs the transition to 1 December 2023, and s. 76(2) bars proceedings for good-faith processing during it. The Office of the Information Commissioner lists a second instrument on its own gazette register, published at `sites/default/files/publications/DPA Appointed Day Notice 01Dec2023.pdf`, and has operated a controller-registration regime from that date. **That second notice has not been read.** It is a pure JBIG2 image scan with no text layer, and this box has no OCR, no `jbig2dec` and no PDF rasteriser, so its section list could not be extracted; the 1 December 2023 date and the inclusion of s. 12 rest on the s. 76 two-year term, the notice's own filename on the regulator's host, and the registration regime going live, not on the enumerated sections. Confidence is held at medium for that reason alone — the substantive text of s. 12 is verified verbatim against the Act and is not in doubt. To close the gap, read the section list in the 2023 Appointed Day Notice on a box with OCR, or obtain the Gazette Supplement in text form; that would move confidence to high without changing the date. No offence attaches to s. 12 directly, and tracing that took reading the enforcement architecture rather than the penalty schedule. The primary remedy is internal to the section: under s. 12(5), where the Commissioner is satisfied on a data subject's application that a controller has failed to comply with a notice under s. 12(2) or s. 12(3)(b), the Commissioner «may order the data controller to reconsider the decision, or to take a new decision, that is not based solely on such processing as is described in subsection (2)», and s. 12(6) confines the order's effect to the data subject and the controller. The enforcement-notice route at s. 44(2) is narrower than it looks — it is available only where the Commissioner is satisfied that a controller «has contravened, or is contravening, any of the data protection standards», so it reaches s. 12 only through a standard rather than through the section itself. Where an enforcement, assessment or information notice is served and disobeyed, s. 52(1) creates the offence and s. 52(4) sets the penalty at a fine not exceeding one million Jamaican dollars on conviction in a Parish Court, with a due-diligence defence at s. 52(3); a false statement in purported compliance with an information or assessment notice is the same offence class under s. 52(2). The ceiling sits elsewhere: s. 68(1) makes a body corporate that commits any offence under the Act liable, notwithstanding any other penalty specified in the Act, to a fine not exceeding four per cent of annual gross worldwide turnover for the preceding year of assessment, with s. 68(2) listing the quantum factors and s. 68(3) extending liability to a consenting or conniving director, manager or secretary. Section 75 lets the Minister amend any monetary or fixed penalty by affirmative-resolution order. Impact tier: all entities. 1 obligation tracked — 1 in force.

Jamaica does not follow the GDPR art. 22 pattern its Caribbean neighbours use. Section 12 of the Data Protection Act, 2020 (Act 7 of 2020) is drafted on the United Kingdom's Data Protection Act 1998 s. 12 and is a notice-based right rather than a standing prohibition. Section 12(1) fixes the trigger: the section «applies to a decision, other than an exempt decision, taken by or on behalf of a data controller and which significantly affects a data subject». Section 12(2) then gives the individual the entitlement «at any time, by notice in writing to the data controller, to require the data controller to ensure that no decision to which this section applies is based solely on the processing, by automatic means, of personal data in respect of the data subject for the purpose of evaluating matters relating to the data subject (for example, the individual's performance at work, creditworthiness, reliability, or conduct)». Nothing bars the decision until that notice is served. What lifts Jamaica above the 1998 model is s. 12(3), which bites where no notice has been served. Where a controller who has not received a s. 12(2) notice takes a decision to which the section applies, the controller «shall, as soon as is reasonably practicable, inform the individual that the decision was made on the basis described in subsection (2)», and the individual is then entitled, within thirty days of receiving that information, to require the controller by written notice «to reconsider the decision or make a new decision otherwise than on that basis». Section 12(4) gives the controller thirty days from that notice to supply a written statement of the steps it intends to take. This is an unconditional, controller-side disclosure duty attaching to every solely-automated significant decision — the Jamaican Act volunteers the fact of automation, which the Zambian and Mauritian statutes do not. The exemptions sit at s. 12(7)-(8) and are narrower than GDPR art. 22(2) because both limbs must be met. An «exempt decision» is one authorised or required by or under any enactment, or made in the course of steps taken to consider entering into or to perform a contract with the data subject — and, cumulatively, either the effect of the decision is to grant a request of the data subject, or steps have been taken to safeguard the data subject's legitimate interest, «for example, by allowing the data subject to make representations». There is no consent limb at all: consent is not a route out of s. 12 in Jamaica. The logic limb is separate and reactive. Section 6(2)(d) entitles an individual, where processing by automatic means of his personal data «is for the purpose of evaluating matters relating to that individual (such as, for example, the individual's performance at work, creditworthiness, reliability, or conduct)» and «has constituted or is likely to constitute the sole basis for any decision significantly affecting the individual», «to be informed by the data controller, upon payment of the prescribed fee, of the logic involved in that decision-taking». Note the fee: Jamaica is one of the few jurisdictions on this tracker where the explanation right is expressly chargeable. Section 6(7)(a) lets the Commissioner require the logic information to be produced for inspection when adjudicating a s. 6(6) application, but s. 6(7)(b) bars disclosure to the applicant pending determination in the applicant's favour. Commencement is phased and the phasing matters. Section 1(1) provides that the Act «shall come into operation on a day appointed by the Minister by notice published in the Gazette, and different days may be appointed in respect of different provisions of this Act». The first Appointed Day Notice — the Data Protection Act, 2020 (Sections 2, 4, 56, 57, 60, 66, 74 and 77 and First Schedule) (Appointed Day) Notice, 2021, No. 221, Jamaica Gazette Supplement Vol. CXLIV No. 160, dated 30 November 2021 and read in full here — appointed 1 December 2021 for ss. 2, 4, 56, 57, 60, 66, 74 and 77 and the First Schedule only. Those are the Office of the Information Commissioner's own constitutive provisions. **Section 12 was not among them**, so the automated-decision right was not in force in 2021, and any source dating this obligation to 1 December 2021 is reading the wrong notice. The operative date is the second notice. Section 76(1) requires a data controller to secure full compliance «on or before the expiration of a period of two years from the earliest day appointed under section 1(1)», which runs the transition to 1 December 2023, and s. 76(2) bars proceedings for good-faith processing during it. The Office of the Information Commissioner lists a second instrument on its own gazette register, published at `sites/default/files/publications/DPA Appointed Day Notice 01Dec2023.pdf`, and has operated a controller-registration regime from that date. **That second notice has not been read.** It is a pure JBIG2 image scan with no text layer, and this box has no OCR, no `jbig2dec` and no PDF rasteriser, so its section list could not be extracted; the 1 December 2023 date and the inclusion of s. 12 rest on the s. 76 two-year term, the notice's own filename on the regulator's host, and the registration regime going live, not on the enumerated sections. Confidence is held at medium for that reason alone — the substantive text of s. 12 is verified verbatim against the Act and is not in doubt. To close the gap, read the section list in the 2023 Appointed Day Notice on a box with OCR, or obtain the Gazette Supplement in text form; that would move confidence to high without changing the date. No offence attaches to s. 12 directly, and tracing that took reading the enforcement architecture rather than the penalty schedule. The primary remedy is internal to the section: under s. 12(5), where the Commissioner is satisfied on a data subject's application that a controller has failed to comply with a notice under s. 12(2) or s. 12(3)(b), the Commissioner «may order the data controller to reconsider the decision, or to take a new decision, that is not based solely on such processing as is described in subsection (2)», and s. 12(6) confines the order's effect to the data subject and the controller. The enforcement-notice route at s. 44(2) is narrower than it looks — it is available only where the Commissioner is satisfied that a controller «has contravened, or is contravening, any of the data protection standards», so it reaches s. 12 only through a standard rather than through the section itself. Where an enforcement, assessment or information notice is served and disobeyed, s. 52(1) creates the offence and s. 52(4) sets the penalty at a fine not exceeding one million Jamaican dollars on conviction in a Parish Court, with a due-diligence defence at s. 52(3); a false statement in purported compliance with an information or assessment notice is the same offence class under s. 52(2). The ceiling sits elsewhere: s. 68(1) makes a body corporate that commits any offence under the Act liable, notwithstanding any other penalty specified in the Act, to a fine not exceeding four per cent of annual gross worldwide turnover for the preceding year of assessment, with s. 68(2) listing the quantum factors and s. 68(3) extending liability to a consenting or conniving director, manager or secretary. Section 75 lets the Minister amend any monetary or fixed penalty by affirmative-resolution order. Impact tier: all entities.

✓ checked 1 Oct 2026 primary source ↗