| Obligation | What it means | Source |
|---|---|---|
| Register with the OIC | Every data controller must register, renew by 1 December each year, and report changes within 14 days. | Act s.15 and 16; Data Controller Registration Regulations, 2024 |
| Registration fees | First registration: J$25,000 for a company, J$15,000 for a partnership, J$7,500 for a sole trader. Annual renewal: J$15,000, J$10,000 and J$5,000. | Data Controller Registration Regulations, 2024, Schedule |
| Follow the eight standards | Fair and lawful processing, purpose limits, accuracy, retention, security, overseas transfers and more. | Act Part IV |
| Annual impact assessment | Submit a Data Protection Impact Assessment to the OIC within 90 days after the end of each calendar year. | Act s.45 |
| Report breaches fast | Tell the OIC within 72 hours of becoming aware of a breach, and notify affected people within 72 hours too | Act s.21; Data Protection Regulations, 2024, reg. 10 |
| Answer access requests | Respond within 30 days. A further 45 days is allowed in limited cases, as long as you tell the person in writing. | Act s.6; Data Protection Regulations, 2024, reg. 4 |
| Appoint a DPO where required | Required for public authorities, for anyone processing sensitive data, and for large-scale processing. The DPO can be outsourced. | Act s.20; Data Protection Regulations, 2024, reg. 9 |
| Retain and dispose properly | Keep retention and disposal policies, and destroy data so it can't be recovered or linked back to anyone. | Disposal of Personal Data Regulations, 2024 |
