Guide to Data Protection Act for Data Controllers

Who does the DPA apply to?

At a glance

  • The DPA applies to personal data processed by ‘data controllers’ and ‘data processors’.
  • A ‘data controller’ determines why and how personal data is processed.
  • A ‘data processor’ processes personal data on behalf of a data controller and does not itself determine why personal data should be processed. A data processor may, to a certain extent, decide on how the personal data should be processed.
  • A data controller who engages a data processor must ensure that the engagement is based on a written contract which contains certain prescribed assurances regarding the processing of personal data.
  • The DPA applies to processing carried out by organizations established within the Cayman Islands, as well as to organizations established outside the Cayman Islands that process personal data within the Cayman Islands.
  • The DPA does not apply to processing carried out by individuals purely for personal/household activities.
Previous Next