The Cayman Islands Data Protection Act (2021 Revision) applies to any business established in Cayman or processing personal data in the context of Cayman operations, and it carries real enforcement teeth. At wb.group, we help funds and companies understand their obligations under the Act: from drafting privacy notices and reviewing data flows, to responding to subject access requests and managing breach notification within the five-day reporting window.
Most Cayman businesses collect and process personal data, whether through employees, investors, customers or service providers. What many organisations underestimate is that the Cayman Islands Data Protection Act (2021 Revision) imposes specific legal obligations on how that information is collected, used, stored and shared, backed by significant regulatory and criminal penalties for non-compliance.
The Office of the Ombudsman can fine controllers up to CI$250,000 and pursue criminal prosecution for the most serious contraventions, while any reportable breach must reach both the affected individual and the Ombudsman within five days of discovery. These obligations apply to organisations established in the Cayman Islands or processing personal data in the context of Cayman operations, including companies, partnerships, trusts, investment funds and other Cayman structures.
This article sets out who falls within scope under the Act, the eight principles that govern compliance and the practical steps every organisation should have in place.
The Basics: Who’s In Scope?
If your organisation is established in the Cayman Islands and processes personal data, or processes personal data in the context of activities carried on in the Cayman Islands, the DP Act is likely to apply.
The rules don’t care where the individual is based. If you are established in the Cayman Islands or processing personal data in the context of Cayman operations, the DP Act is likely to apply.
What is a Data Controller and a Data Processor?
If you decide how and why personal data is processed, you’re a data controller. If you’re processing it on someone else’s behalf – think fund administrators, cloud platforms, or payroll providers – you’re a data processor. While the controller retains primary responsibility for compliance, processors are also subject to certain obligations under the Act and should ensure that appropriate contractual and operational safeguards are in place.
The Eight Core Principles
The DP Act sets out eight key principles that every business handling personal data must follow:
- Fair and lawful processing
- Defined purposes
- Data minimisation
- Accuracy
- Storage limitation
- Respect for individual rights
- Security and confidentiality
- Controls around international transfers
Miss one, and you risk both reputational damage and regulatory penalties.
What are the Standards for Handling Sensitive Data?
Sensitive personal data includes information relating to an individual’s racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, physical or mental health, sexual life, criminal convictions, genetic data and biometric data used for identification.
What Counts as Valid Consent?
If you’re relying on consent, it must be active, informed, and recorded. Silence or pre-ticked boxes don’t cut it. Consent must also be easy to withdraw, and employers should be particularly cautious given the inherent power imbalance in staff relationships.
How are Cross-Border Data Transfers Affected?
You can’t just export personal data from Cayman without considering where it’s going. Transfers to countries that don’t meet the ‘adequate protection standard (as defined under the DP Act) require appropriate safeguards or another lawful basis for transfer, such as consent or contractual protections.
What Individual Rights do People Have?
Data subjects have the right to know what you hold, access their data, correct inaccuracies, stop or limit processing, opt out of direct marketing, challenge automated decisions, and lodge complaints or seek redress. You need systems in place to respond – and quickly. The deadline to respond to valid access requests is 30 days.
What Happens if You Have a Breach?
Certain personal data breaches must be reported to the Office of the Ombudsman and affected individuals as soon as reasonably practicable, and no later than five days after the data controller becomes aware of the breach.
What Enforcement and Penalties Can the Regulator Issue?
The Ombudsman has the power to issue enforcement orders and seek significant monetary penalties, with the most serious contraventions carrying fines of up to CI$250,000 and potential criminal liability. The Ombudsman has the power to investigate complaints, conduct inspections and take enforcement action where appropriate.
What Should You Be Doing Now?
If you’re in scope, we recommend:
- Drafting and distributing a clear privacy notice
- Reviewing how you collect, use, and store personal data
- Updating contracts with third-party service providers
- Checking your cross-border transfer processes
- Ensuring you can respond to subject access requests within 30 days
- Establishing breach reporting procedures
For investment funds, that means updating offering and subscription documents, privacy notices, and service agreements with administrators and tech providers.
Need help navigating the Cayman Data Protection Act? Reach out to wb.group for straight-talking advice.