With the December 1st registration deadline for data controllers to get complaint under the Jamaica Data Protection Act (DPA) fast approaching, businesses are being urged to step up their data privacy efforts.

Speaking at the recently concluded Jamaica’s Technology and Digital Alliance (JTDA) BizTech 2024 Conference, Stuart Hylton, director of assurance and compliance at Symptai Consulting Limited, called on companies to conduct greater evaluation of their data-handling practices and to designate knowledgeable personnel to oversee privacy initiatives.

“Compliance does not happen by accident. It requires deliberate action, dedicated resources, and a commitment to protecting the trust of your customers. Why wait to see what happens when you can act now? The cost of inaction is far greater than the effort of ensuring compliance today,” he told attendees during a workshop held as part of the conference’s activities.

The DPA, passed in 2020, was drafted as a critical piece of legislation which seeks to ensure the responsible handling and protection of personal information. Under the Act, data controllers, which include companies, individuals and other entities that process or store customer information, have a duty to maintain the safe keeping of client database.

The process of registration, which commenced on June 1, 2024, now sees data controllers looking to complete enrollment with the Office of the Information Commissioner (OIC) for the first year period, which runs from December 1, 2023 to November 30, 2024. Following this initial registration period, all data controllers are expected to renew their registrations and to pay the prescribed fees on or before December 1 for each registration year thereafter.

As the country’s chief regulator of data protection, the OIC led by Information Commissioner Celia Barclay, has so far been processing applications for a number of data controllers across various sectors based on an order of priority. To data, over 150 persons from different organisations have been duly registered to process data in keeping with sections 15 (1), 16 and 17 (1) of the Act.

Highlighting the benefits of becoming fully complaint, the director said that outside of the possible costs which could stem from breaches, companies in becoming compliant can also take advantage of other opportunities that will help them to enhance their business processes, increase productivity and to generally improve levels of public trust and service delivery.

“Data protection isn’t just about avoiding penalties; it’s about positioning your business for long-term success. Compliance is not just for large enterprises — small businesses also stand to gain significant value by investing in data privacy,” he stated.

In noting the work of his firm with a number of organisations locally and across the region, Hylton said the entity has likewise been taking steps to navigate the complexities of compliance. Outside its suite of technological solutions, he said the company offers support through educational initiatives such as free webinars to equip businesses with practical tools and insights.

“In response to a growing regional urgency, Symptai has also been expanding its call to action beyond Jamaica, as we continue to work with organisations across the region in the various stages of enacting and executing protection regulations. This includes Bermuda, where the Personal Information Protection Act (PIPA) is expected to come into effect on January 1, 2025,” Hylton said.

Group CEO for global data privacy firm Securys Ben Rapp, who also spoke at the conference, further underscored the importance of data protection and the need to become compliant with these laws. With Jamaica now engaging a number of large multinational companies, he said many of these have certain vendor assessments (including data protection requirements) which entities locally must first pass in order to do business with them.

“A functional data regime will therefore allow Jamaica to trade with the world, further powering the country’s economy,” he said.