Year of Data Protection Act: What Happened and What’s Next

A lot can change in a year when a law stops being “something we should get to” and becomes a real expectation from customers, partners, and regulators. For many Jamaican organisations, the last year has felt like the Year of the Data Protection Act: privacy moved from policy binders into day-to-day operations, vendor conversations, and board risk discussions.

This article looks at what typically “happened” during the past year of Data Protection Act readiness in Jamaica (the wins and the pain points), and what’s next for organisations that want to be confident in 2026 and beyond.

First, what “year” are we talking about?

If you are searching for the “year of the Data Protection Act” in Jamaica, here are the two most important ways people use that phrase:

• The year the law was made: Jamaica’s Data Protection Act was enacted in 2020. You can review the legislation via official sources such as Jamaica Laws Online (search “Data Protection Act”).

• The year organisations started treating it as operational reality: regardless of formal commencement phases, many organisations only shifted into true implementation mode when they felt pressure from procurement requirements, incident risk, customer trust expectations, and internal audit.

So, when leaders say “this was the Year of the Data Protection Act,” they usually mean: we moved from awareness to evidence.

What happened during the Year of the Data Protection Act (in practice)

Across sectors (financial services, retail, hospitality, BPO, education, healthcare, NGOs), several patterns tend to show up once privacy work becomes real.

1) Privacy stopped being a document exercise

Early privacy efforts often focus on producing artefacts: a privacy policy, a consent form, a template contract clause. Over the past year, more organisations realised that documentation is only credible if it matches reality.

The shift looked like this:

2) Data discovery became the hardest and most valuable work

Organisations that progressed fastest generally did one thing early: they confronted where personal data actually lives.

That means identifying:

• “Official” systems (HRIS, CRM, accounting, POS, student systems)

• Shadow tools (spreadsheets, personal email, WhatsApp threads, shared drives)

• Vendor platforms (marketing tools, cloud hosting, call recording, payroll processors)

• Physical records (paper files, archived boxes, visitor logs)

This is why data mapping and inventory work tends to dominate the first serious year. Without it, you cannot confidently answer basic questions like “Who can access this?” and “How long do we keep it?”

3) Vendor risk moved from “legal fine print” to “operational exposure”

One of the most visible changes in the past year is how procurement and vendor management started treating privacy as part of business risk.

Examples we have seen organisations prioritise:

• Updating contracts to clarify controller/processor responsibilities

• Ensuring vendors can support rights requests (access, correction, deletion where applicable)

• Verifying security controls and breach notification commitments

• Documenting cross-border transfer considerations when data is stored or accessed overseas

This is also where many organisations discovered they needed a repeatable vendor review process, not just one-off contract edits.

4) Rights requests became a “stress test” for governance

Even when organisations are not receiving a high volume of requests, a single well-scoped rights request can expose weaknesses:

• Data is scattered across systems and staff inboxes

• There is no intake process or identity verification approach

• Teams argue about who owns the response

• There is no log showing what was done and when

During the Year of the Data Protection Act, mature organisations moved toward a simple operational model: intake, triage, search, review, respond, record evidence.

5) Security conversations started including privacy outcomes

Privacy and cyber security are closely linked, but not identical. Over the past year, many organisations began connecting security controls to privacy obligations, for example:

• Least-privilege access as a privacy control (not only an IT control)

• Encryption and secure disposal as privacy-enabling practices

• Incident response plans that explicitly consider personal data exposure

For recognised security guidance, many organisations align testing and safeguards to frameworks like the NIST Cybersecurity Framework, then translate those controls into privacy evidence.

The biggest lessons learned (what slowed organisations down)

Most “stalls” in privacy implementation are not caused by lack of intent. They come from predictable friction points.

Data ownership is unclear

If no one can answer “Who owns this dataset?” privacy work becomes negotiation-heavy. The most effective organisations assign owners at the business process level (HR owns employee records processes, Sales owns CRM processes, Operations owns CCTV processes, and so on).

Retention is uncomfortable because it forces decisions

Retention schedules are where privacy meets business reality. Many organisations had never formally agreed how long to keep:

• Former employee files

• Applicant CVs

• CCTV footage

• Customer support recordings

• Marketing lists

The Year of the Data Protection Act pushed organisations to decide, document, and implement disposal.

Training did not always change behaviour

One-off training sessions can raise awareness, but they do not always change daily habits (forwarding spreadsheets, using personal devices, sharing passwords, storing files indefinitely). Stronger programmes added role-based refreshers and simple controls like templates, approved tools, and escalation paths.

“We have a policy” was not the same as “we can prove it”

Audit readiness is about evidence. Organisations that did well created small, practical evidence packs.

Here is a helpful way to think about it:

If you want a broader compliance structure tailored to Jamaica, PLMC’s resources such as Data Privacy in Jamaica: Key Principles and Rights provide a solid grounding without treating privacy as purely theoretical.

What’s next: the priorities that matter in 2026

Once an organisation has moved through the first serious year of implementation, “what’s next” is less about writing policies and more about strengthening controls and proving they work.

Move from implementation to assurance

A strong 2026 focus is testing and validation:

• Can you complete a rights request end-to-end using your actual systems and staff?

• Can you identify personal data impacted during an incident within hours, not days?

• Can you show vendor oversight beyond contract signatures?

This is the point where privacy starts to look like other mature risk disciplines: measured, reviewed, and improved.

Improve vendor governance, especially for cross-border processing

As Jamaican organisations increasingly rely on cloud services and regional or global vendors, cross-border processing is normal. What changes in 2026 is the expectation that organisations can explain and govern it.

Practical next steps include:

• Maintain a list of vendors with access to personal data

• Classify vendors by risk (what data, what volume, what criticality)

• Standardise security and privacy questions in procurement

• Ensure the business can answer “Where is the data stored and who can access it?”

Embed privacy into projects (not after go-live)

Privacy by design is one of the most cost-effective moves you can make. The “next” stage is integrating privacy checks into:

• New system rollouts

• Marketing campaigns and data sharing partnerships

• HR initiatives (biometrics, monitoring tools, background checks)

• Customer experience changes (new apps, loyalty programmes, analytics)

It is easier to design a compliant process than to retrofit one.

Elevate board and senior management reporting

By 2026, privacy should be part of regular governance reporting, including:

• Status of the privacy programme roadmap

• Key risks and mitigation actions

• Incident trends and lessons learned

• Training completion and behavioural indicators

• Vendor risk hotspots

This is where privacy becomes sustainable, because it is measured like any other enterprise risk.

For a quarter-by-quarter view focused on measurable outcomes, you can also use PLMC’s existing guide: Data Protection Jamaica: Compliance Roadmap for 2026.

A simple way to plan your next 60 to 90 days

If the past year got you from “policy” to “partial implementation,” the next 60 to 90 days should aim to create confidence through repeatable routines.

A practical short-cycle plan looks like this:

• Confirm ownership: assign accountable owners for key processing areas (HR, Marketing, IT, Operations) and agree escalation paths.

• Complete or refresh the data inventory: focus on the highest-risk datasets first (employee, customer financial, health-related, children’s data where relevant).

• Run one rights request simulation: time it, document it, and fix the bottlenecks.

• Run one incident tabletop exercise: ensure the team can identify affected individuals, impacted systems, and required communications quickly.

• Tighten vendor oversight: pick the top 10 vendors by risk and ensure contracts, security posture, and breach expectations are documented.

• Produce an evidence pack: keep it simple, a well-organised folder with the latest approved documents, logs, and test outputs.

This approach keeps privacy from becoming an endless project. It becomes a management system.

Where PLMC can support your “what’s next” stage

If you are past awareness and now need execution, the support that tends to create the most momentum is:

• A structured gap assessment that prioritises fixes based on risk and effort

• Hands-on implementation support for policies, notices, rights workflows, vendor governance, and retention

• Staff training that is role-based (HR, customer service, IT, marketing, leadership)

• Integrated Governance, Risk, & Compliance alignment so privacy controls are consistent with cyber security, corporate governance, and AML expectations

PLMC offers practical support for Jamaican organisations working toward Data Protection Act compliance, including training sessions, risk assessment tools, and free consultations. You can also explore the broader set of guidance materials in the PLMC blog if you are building internal capability.

The core takeaway from the Year of the Data Protection Act is simple: privacy progress accelerates when you stop chasing perfect documentation and start building operational proof. What comes next in 2026 is strengthening that proof through testing, vendor governance, and accountability that leadership can stand behind.