The Office of the Information Commissioner (OIC) has begun a phased implementation of the Data Protection Act, 2020, which runs from June 1, 2024, through to August 31, 2024.

Since Saturday, June 1, 2024, data controllers could begin registering with the OIC for the first registration year: the period from December 1, 2023, to November 30, 2024.

During this initial phase, the OIC will be focusing on processing the registration applications of data controllers in particular priority groups as determined by the OIC, balancing the rights and interests of all persons. 

As a priority, the OIC will register data controllers from all public authorities, as defined by the Act.

It will then shift focus to other data controllers processing personal data, including sensitive personal data or data related to criminal convictions, for an estimate of 10,000 or more data subjects. Such data controllers operate within sectors such as education, finance, health, information and communication technologies (ICT), and tourism and hospitality 

“Notwithstanding the above, any data controller – including sole proprietors/practitioners or operators of micro, small and medium-sized enterprises (MSMEs) across all sectors or industries – can submit their application for registration,” the OIC stated.

“Data controllers must have a validated data controller account to access the Registration Form on the My OIC Portal of the OIC’s website at www.oic.gov.jm. Data controllers who have not yet created their unique data controller accounts are encouraged to do so now,” it added.

On June 1, 2024, data controllers with accounts were granted access to the registration form where they may enter their registration details. They may save and close the registration form if they are unable to enter all particulars at one time. They will have 30 days from the date of first log-in to complete and submit the application and upload any supporting documents in PDF.

After completing the registration form, data controllers should pay the prescribed fees. The information of data controllers who have successfully registered with the OIC will be published in the online Register of Data Controllers, pursuant to section 17 of the Act, for the remainder of this current registration year.

Data controllers are required to renew their registration and pay the prescribed fees on or before December 1 every year after the first registration.