Jamaica Data Protection Act 2020 JM-DPA2020-Joint-Controller-Processor-Sec24-25-26-Arrangements-Allocation-Responsibilities-Contracts: Jamaica DPA 2020 Joint Controllers + Processors + Sections 24-26 + Arrangements + Allocation of Responsibilities + Contracts + Records of Processing Activities (ROPA) + Sub-Processors + Vendor Management
Sections 24-26 of the Jamaica DPA 2020 establish the framework for Joint Controllers + Processors + Sub-Processors + and Records of Processing Activities. (1) Section 24 Joint Controllers: (a) two or more controllers jointly determine purposes and means of processing; (b) MUST agree in TRANSPARENT MANNER respective responsibilities for compliance + particularly regarding (i) exercise of data subject rights; (ii) Privacy Notice information; (c) arrangement made available to data subjects; (d) data subjects may exercise rights against either controller. (2) Section 25 Records of Processing Activities (ROPA): (a) MANDATORY for controllers + processors; (b) Section 25(2) Controller ROPA contents - (i) controller identity + contact details + DPO; (ii) purposes; (iii) categories of data subjects; (iv) categories of personal data; (v) categories of recipients; (vi) transfers + adequacy mechanism; (vii) retention; (viii) security measures (general description); (c) Section 25(3) Processor ROPA contents - (i) processor identity + DPO; (ii) controller identity; (iii) categories of processing; (iv) transfers + adequacy mechanism; (v) security measures; (d) Section 25(4) ROPA in writing + electronic + available to OIC on request; (e) Section 25(5) exemption for organisations under 250 employees IF processing not regular + sensitive + risk to rights. (3) Section 26 Processor Contracts: (a) processing by processor governed by contract + binding legal act; (b) Section 26(2) MANDATORY contract terms - (i) subject-matter + duration + nature + purpose; (ii) type of personal data + categories of subjects; (iii) controller obligations + rights; (iv) processor (a) processes only on documented controller instructions; (b) ensures confidentiality of authorised personnel; (c) takes Section 35 security measures; (d) respects sub-processor authorisation conditions; (e) assists controller with Section 37-43 data subject rights; (f) assists controller with Section 28-30 breach + Section 34 DPIA + Section 27 transfers; (g) deletes or returns all data at end of contract; (h) makes available information demonstrating compliance + audits; (i) immediately informs controller of unlawful instructions. (4) Sub-Processor Authorisation: (a) processor must obtain prior specific or general written authorisation; (b) general authorisation - processor informs controller of intended changes + controller may object; (c) sub-processor flow-down of contract obligations; (d) processor remains fully liable to controller for sub-processor performance. (5) Records + Audit: (a) controller right to audit processor (annual or on demand); (b) processor cooperation with controller audits + OIC audits; (c) certification (ISO 27001 + ISO 27701 + SOC 2) may demonstrate compliance + does not replace audit right. (6) Processor Becoming Controller: (a) processor processing beyond instructions becomes controller for that processing; (b) liability shifts; (c) Section 24 joint controller status may apply. (7) Inter-Group + Affiliate Processing: (a) intra-group can use processor mechanism; (b) BCR Binding Corporate Rules may simplify intra-group transfers (Section 27); (c) Section 24 joint controller for shared purposes. (8) Cloud + SaaS: (a) cloud provider often processor; (b) shared responsibility model; (c) sub-processor chain visibility; (d) cloud-region data residency for adequacy; (e) Section 26 contract clauses adapted for cloud terms. (9) Vendor Due Diligence: (a) security questionnaire + SOC 2 + ISO 27001 review; (b) financial stability; (c) reputational; (d) jurisdiction + legal regime; (e) sub-processor chain; (f) DPIA Section 34 if high-risk. (10) Penalties: (a) Section 50 administrative penalties for joint controller + processor failures; (b) Section 26 contract absence is administrative violation; (c) controller liable for processor breaches in some circumstances. Coordinates with EU GDPR Articles 26 + 28 + 30 + UK DPA 2018 + Convention 108+ + EDPB Guidelines on Controllers and Processors + ISO/IEC 27701 + Jamaica Section 22 Privacy Notice + Section 27 Transfers + Section 28-30 Breach + Section 34 DPIA + Section 35 Security. Jamaica DPA 2020 Sections 24-26 applies.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 196 controls across 52 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.