Jamaica Data Protection Act 2020, section 12 on automated decision-taking

What it is

The Data Protection Act 2020 (Act No. 7 of 2020) is Jamaica’s data protection law. Its substantive provisions came into operation on 1 December 2023, and it is overseen by the Information Commissioner, whose office handles data controller registration, breach reports and complaints. Section 12, titled “Rights in relation to automated decision-taking”, is the Act’s rule on decisions made by algorithms, including AI systems, about people.

The drafting follows the UK’s Data Protection Act 1998 closely. Section 12 is a rights-based rule. It does not prohibit automated decisions. It gives the person affected a way to stop them in advance or to require a fresh decision afterwards, and it makes the data controller tell people when a decision has been made that way.

Who it applies to

The Act applies to data controllers, the people and organisations that decide the purposes for which and the way personal data is processed. Section 3 brings in controllers established in Jamaica that process data in the context of that establishment. It also reaches controllers established elsewhere that use equipment in Jamaica for processing other than transit, or that process the personal data of people in Jamaica in connection with offering them products or services or monitoring their behaviour there. A controller outside Jamaica that falls within section 3 must appoint a representative in Jamaica.

The duty sits with the controller. An organisation that uses a vendor’s AI system to score loan applicants or screen job candidates is still the controller for those decisions.

What it requires

Section 12 applies to a decision taken by or for a data controller that significantly affects a data subject and is based solely on processing by automatic means of their personal data to evaluate matters relating to them. The Act’s examples are performance at work, creditworthiness, reliability and conduct.

• Notice to stop. Under section 12(2) an individual can, at any time, require the controller by written notice to ensure that no such decision about them is based solely on automatic processing.
• Telling people after the fact. Under section 12(3), where the controller has had no such notice and takes a decision of this kind, it must tell the person, as soon as reasonably practicable, that the decision was made on that basis.
• Reconsideration. The person then has 30 days to require the controller, in writing, to reconsider the decision or take a new one on a different basis. The controller has 30 days from receiving that notice to give a written statement of the steps it intends to take (section 12(4)).
• Commissioner’s order. If a controller fails to comply, the Commissioner can order it to reconsider the decision or take a new one not based solely on automatic processing (section 12(5)).

Exempt decisions are outside section 12. Under section 12(8), a decision is exempt where it is authorised or required by law, or is taken in considering, entering into or performing a contract with the person, and either it grants what the person asked for or steps have been taken to safeguard their legitimate interests, for example by letting them make representations. Other exempt circumstances may be prescribed by regulation.

Section 6 adds a related right of access. Where automatic processing that evaluates a person has been, or is likely to be, the sole basis for a decision significantly affecting them, they are entitled on request, and on payment of the prescribed fee, to be told the logic involved.

For an AI system this turns into practical questions. Which systems decide things about people with significant effect, and is a person genuinely involved before a decision takes effect? How will the organisation tell someone a decision was automated, and receive and act on a reconsideration notice within 30 days? And can it explain the logic well enough to answer an access request?

The rest of the Act applies alongside section 12. The eight data protection standards in Part IV cover lawful and fair processing, purpose limitation, accuracy, retention, security and transfers out of Jamaica. Section 20 requires public authorities, large-scale processors and processors of sensitive data to appoint a data protection officer. Section 21 requires contraventions and security breaches affecting personal data to be reported to the Commissioner within 72 hours. Section 45 requires controllers to submit a data protection impact assessment to the Commissioner each year, within 90 days after the end of the calendar year, unless the Commissioner’s Gazette notice says otherwise.

Key dates

• 2020. The Data Protection Act passed as Act No. 7 of 2020.
• 1 December 2023. The Act’s substantive provisions come into operation.
• 1 April 2026. Jamaica launches UNESCO’s AI Readiness Assessment, a step towards a national AI policy.

How it relates to other frameworks

Section 12 is close to the version of the UK rule that applied before the GDPR, and narrower than GDPR Article 22 and today’s UK GDPR rules. Those restrict solely automated decisions by default, while Jamaica’s Act lets them proceed unless the person objects, and then gives a route to reconsideration. South Africa’s POPIA section 71 sits between the two.

Jamaica has no AI-specific law. The government has a National AI Task Force, and the UNESCO readiness assessment launched in April 2026 is meant to turn its findings into policy. Until a national policy is in place, organisations using AI in Jamaica often pair the Data Protection Act with an international framework such as ISO/IEC 42001 or the NIST AI RMF to structure their risk and impact assessments.

A note on this page

This is Aicura’s reading of section 12 of the Data Protection Act 2020. It is not legal advice and it is not the Act itself. Read the primary source published by the Office of the Information Commissioner, and take advice on how the Act applies to your organisation.