Guide to Data Protection Law 2017 for Data Controllers

Who does the DPL apply to?

At a glance

  • The DPL applies to personal data processed by ‘data controllers’ and ‘data processors’.
  • A ‘data controller’ determines why and how personal data is processed.
  • A ‘data processor’ processes personal data on behalf of a data controller and does not itself determine why personal data should be processed. A data processor may, to a certain extent, decide on how the personal data should be processed.
  • A data controller who engages a data processor must ensure that the engagement is based on a written contract which contains certain prescribed assurances regarding the processing of personal data.
  • The DPL applies to processing carried out by organizations established within the Cayman Islands, as well as to organizations established outside the Cayman Islands that process personal data within the Cayman Islands.
  • The DPL does not apply to processing carried out by individuals purely for personal/household activities.
Previous Next