Registration of Data Controllers Begins June 1

The Office of the Information Commissioner (OIC) is reminding data controllers to commence registration as of June 1, 2024.

Applications are being accepted for the December 1, 2023 to November 30, 2024, period.

Under the Data Protection Act (DPA) 2020, data controllers are considered to be organisations or individuals that process the personal information of others.

Registration was initially scheduled to begin on December 1, 2023, the official implementation date of the Act, but the Government granted a six-month grace period for entities to become complaint.

Speaking with JIS News, Information Commissioner, Celia Barclay, said the entity will be processing registration applications for specific groups up to August 31.

Among these priority groups are all public authorities along with data controllers operating within sectors such as Education, Finance, Health, Information and Communications Technology (ICT), Tourism, and Hospitality.

“Notwithstanding this, any data controller, including sole proprietors or practitioners or operators of micro, small and medium-sized enterprises (MSMEs) across all sectors or industries can submit their application for registration,” Ms. Barclay said.

Outlining the process, she noted that data controllers must have a validated data controller account to initiate the registration process. This is accessible via the My OIC Portal on the organisation’s website.

Upon validation, data controllers will gain access to the registration form and have up to 30 days from their initial log-in to complete and submit the application, along with any required supporting documents.

After submitting the form, data controllers are required to remit the prescribed registration fees, which vary according to the type of entity.

Companies and public authorities are subject to a fee of $25,000, partnerships $15,000, and sole traders and individuals $7,500.

“The particulars of data controllers who have successfully registered with us will be published in the online Register of Data Controllers, pursuant to section 17 of the Data Protection Act for the remainder of this current registration year,” Ms. Barclay said.

Following this initial process, data controllers will be required to renew their registration and pay the prescribed fees on or before December 1 of each year.

For further information and assistance, data controllers are encouraged to visit the OIC’s website, www.oic.gov.jm, or contact the organisation directly.