Data Protection for Organizations

The Office of the Ombudsman has prepared detailed guidance for organizations and guidance for data subjects.

You can find all resources on our resource page.

The organization (controller) itself is responsible. Where the organization is a legal person, such as a company, the internal structure of the organization, as reflected in the company’s constitutional documents, will decide who is responsible for ensuring the organization’s compliance. For example, this may be the board of directors, although the board may delegate specific functions.

Section 58 DPL recognizes personal liability for offences under the DPL committed by a body corporate. The personal liability is assigned to “any director, secretary or similar officer of the body corporate” or “any person who was purporting to act in any such capacity” where it is proved that the offence was committed with those individuals’ consent or connivance or attributable to their neglect.

Our primary goal is to help organizations become compliant and to support individuals in the exercise of their data protection rights.

The Ombudsman has substantial enforcement powers under the DPL. These assume different forms: information orders, enforcement orders, inspection and seizure powers, and monetary penalty orders. 

The Ombudsman takes all relevant circumstances into account when deciding on the appropriateness and severity of enforcement measures, such as:

1. The economic strength of the data controller. This will involve a holistic assessment of the economic unit (eg a relevant group of companies) the data controller belongs to.
2. The nature, gravity, and duration of the infringement, considering the specifics of the processing activity, the number of data subjects affected, and the level of damage or distress suffered by them.
3. The categories of data subjects and the types of personal data involved.
4. Whether the contravention was intentional or negligent in character, as well as the nature of technical and organizational measures taken pursuant to the seventh data protection principle.
5. Any evidence of due diligence towards compliance with the DPL.
6. Any measures taken to mitigate the damage or distress suffered by the data subjects as a result of the data protection violation.
7. The manner in which the contravention became known to the Ombudsman, such as whether through a complaint, the media, or directly from the data controller.
8. The level of cooperation with the Ombudsman concerning the investigation and resolution of the contravention.
9. The data controller’s history of data protection compliance.
10. Any other aggravating or mitigating factors, such as financial benefits gained, or losses avoided, directly or indirectly, from the contravention.

Yes. The DPL applies to organizations of all sizes, as long as they process personal data.

Note that compliance may be relatively easy if you do not engage in complex processing of sensitive types of personal data. The Office of the Ombudsman is preparing specific guidance for non-complex processing.

Read about the applicability of the DPL.

Yes. The processing of any personal data will be subject to the DPA, regardless of when the personal data was collected, as long as it is still being held.

The level of outreach depends on how the personal information was initially collected and what it is used for. Where the individual was likely aware of your identity and the current processing purposes, you will generally not need to actively reach out to the individual. Passive outreach, eg through a privacy notice on your website, should be sufficient. However, where the individual was likely unaware of your identity and/or the current processing purposes, you should actively reach out to the individual to comply with your information obligations.

Read about your information obligations.

Yes. However, section 9(1)(a) DPL excludes such personal data from subject access requests that would demand disproportionate effort. Whether a search represents disproportionate effort depends on a number of factors including the nature of the personal data, what it is required for and what circumstances led to the increased effort required to comply with the subject access request.

Read about subject access requests and the storage limitation principle.

No. The DPL does not require an organization to appoint a DPO, though this may be recommended for certain larger or complex organizations.

Yes, indirectly. The controller remains responsible for any processing activities carried out by its processors under its instructions, as manifested in the data processing agreement with the processor. As such, the processing of the processors must be compliant with the DPA.

Read about data processing agreements.

No. The EU-US Privacy Shield is a bilateral framework between the EU and the US. It provides rights only to individuals in the EU. It does not provide rights to individuals in the Cayman Islands. However, other conditions for transferring personal data to the US may apply.

Read about international transfers of personal data.

The DPL requires that all personal data breaches are reported to both the Ombudsman and the affected individuals within 5 days. However, notification may not be necessary if the breach is unlikely to prejudice the rights and freedoms of the data subjects. To notify the Office of the Ombudsman of a personal data breach, please see the contact page on our website: http://ombudsman.ky/get-in-touch. Please use our breach notification form (forthcoming) to submit the details of the breach. You may also contact us if you are unsure whether a breach is reportable.

Read about personal data breaches.