Article
Your contact form and the Jamaica Data Protection Act
Names, phone numbers and emails from your website are personal data. Here is what Jamaica's data protection law means for a small business website, with links to the official sources.
Short answer: Jamaica's Data Protection Act, 2020 took effect on 1 December 2023. It covers how organisations collect, use, store and share personal information, including what people type into your website forms. Collect only what you need, say why you collect it, keep it safe, and check the Office of the Information Commissioner (OIC) guidance on whether you need to register. This article is general information, not legal advice.
If your website has a contact form, a booking form or a newsletter sign-up, you are collecting personal data: names, phone numbers, emails and sometimes much more. Jamaica now has a law about that.
What the law is
The Data Protection Act, 2020 was passed in 2020 and came into effect on 1 December 2023, as the Jamaica Information Service reported. It covers how personal information is collected, stored, used, disclosed and disposed of, on paper and electronically.
The law uses the term data controller for an organisation or person that decides how and why personal data is processed. The Office of the Information Commissioner says data controllers are required to register with the OIC and pay a fee, and its website explains the registration steps.
Whether and how this applies to your exact business is a question for the OIC or a lawyer. What follows are sensible website habits that line up with the spirit of the law.
Website habits that help
Collect only what you need
A quote request needs a name, a way to reach the person and what they want. It does not need a date of birth or a TRN. Every extra field is more data to protect and one more reason for people to give up on the form.
Say why you collect it
Add a short line near the form: what you will use the details for (to reply to the enquiry) and how to contact you about them. Link a privacy page that explains this in plain words.
Keep it safe
- Make sure the site uses HTTPS (the padlock in the browser)
- Send form messages to an email account protected with a strong password and two-step login
- Do not paste customer details into public group chats
- Delete enquiries you no longer need
Do not add people to marketing lists by surprise
If you want to send offers, ask clearly and let people say no.
Your website
Want this done for your business?
Tell me what you need in a few quick taps. You get a written quote before you pay anything.
What I set up on client sites
On the sites I build, forms ask only for what the business needs, travel over HTTPS, and include a link to a privacy page. Spam protection is added so the inbox is not flooded. If a client needs anything more specific for their industry, such as health information, I point them to the OIC and their own legal adviser.
Sources
- Data Protection Act Takes Effect Today, Jamaica Information Service
- The Data Protection Act, 2020, Houses of Parliament, Jamaica
- What are the obligations of data controllers?, Office of the Information Commissioner
- Registering with the OIC as a data controller, Office of the Information Commissioner
Your website
Want this done for your business?
Tell me what you need in a few quick taps. You get a written quote before you pay anything.
Let's work together
Want a written quote?
Message me with business type, parish, and whether you need booking or payments.