Cayman Islands Introduces Data Protection Act

The Cayman Islands government has introduced the Data Protection Act, 2017, to regulate the collection and processing of personal data.

The Data Protection Act represents Cayman’s first legislative framework on data protection and is intended to safeguard the use and processing of individuals’ personal data, affording them a number of rights in relation to their personal data, including, for example, rights to information as to how their personal data is being used, what is being stored and who it is being shared with. The Data Protection Act is based on the UK model and is structured around eight key principles that data controllers must adhere to:

Personal data must:

1. be processed fairly and lawfully;
2. be collected/processed for specified lawful purposes;
3. be adequate, relevant and not excessive;
4. be accurate and kept up-to-date;
5. not be kept for longer than is necessary;
6. be processed in accordance with the individual’s rights;
7. be kept secure, with adequate measures taken against unauthorised or unlawful processing, and against accidental loss, destruction or damage to persona data; and
8. not be transferred outside the Cayman Islands unless adequate levels of protection exist.

There will be substantial financial and custodial penalties for breaches of the Data Protection Act and all affected businesses and their officers and managers will need to carefully review their data protection practices and policies to ensure compliance with the framework. There will be a number of exemptions under the law and we expect further regulations and guidance to be published in due course. Indeed, it is not yet clear when the new law will come into force but we will provide a further update as and when there is further development.

This publication is for general guidance and is not intended to be a substitute for specific legal advice. Advice should be sought about specific circumstances.