Sections 24-26 of the Jamaica DPA 2020 establish the framework for Joint Controllers + Processors + Sub-Processors + and Records of Processing Activities. (1) Section 24 Joint Controllers: (a) two or more controllers jointly determine purposes and means of processing; (b) MUST agree in TRANSPARENT MANNER respective responsibilities for compliance + particularly regarding (i) exercise of data subject rights; (ii) Privacy Notice information; (c) arrangement made available to data subjects; (d) data subjects may exercise rights against either controller. (2) Section 25 Records of Processing Activities (ROPA): (a) MANDATORY for controllers + processors; (b) Section 25(2) Controller ROPA contents - (i) controller identity + contact details + DPO; (ii) purposes; (iii) categories of data subjects; (iv) categories of personal data; (v) categories of recipients; (vi) transfers + adequacy mechanism; (vii) retention; (viii) security measures (general description); (c) Section 25(3) Processor ROPA contents - (i) processor identity + DPO; (ii) controller identity; (iii) categories of processing; (iv) transfers + adequacy mechanism; (v) security measures; (d) Section 25(4) ROPA in writing + electronic + available to OIC on request; (e) Section 25(5) exemption for organisations under 250 employees IF processing not regular + sensitive + risk to rights. (3) Section 26 Processor Contracts: (a) processing by processor governed by contract + binding legal act; (b) Section 26(2) MANDATORY contract terms - (i) subject-matter + duration + nature + purpose; (ii) type of personal data + categories of subjects; (iii) controller obligations + rights; (iv) processor (a) processes only on documented controller instructions; (b) ensures confidentiality of authorised personnel; (c) takes Section 35 security measures; (d) respects sub-processor authorisation conditions; (e) assists controller with Section 37-43 data subject rights; (f) assists controller with Section 28-30 breach + Section 34 DPIA + Section 27 transfers; (g) deletes or returns all data at end of contract; (h) makes available information demonstrating compliance + audits; (i) immediately informs controller of unlawful instructions. (4) Sub-Processor Authorisation: (a) processor must obtain prior specific or general written authorisation; (b) general authorisation - processor informs controller of intended changes + controller may object; (c) sub-processor flow-down of contract obligations; (d) processor remains fully liable to controller for sub-processor performance. (5) Records + Audit: (a) controller right to audit processor (annual or on demand); (b) processor cooperation with controller audits + OIC audits; (c) certification (ISO 27001 + ISO 27701 + SOC 2) may demonstrate compliance + does not replace audit right. (6) Processor Becoming Controller: (a) processor processing beyond instructions becomes controller for that processing; (b) liability shifts; (c) Section 24 joint controller status may apply. (7) Inter-Group + Affiliate Processing: (a) intra-group can use processor mechanism; (b) BCR Binding Corporate Rules may simplify intra-group transfers (Section 27); (c) Section 24 joint controller for shared purposes. (8) Cloud + SaaS: (a) cloud provider often processor; (b) shared responsibility model; (c) sub-processor chain visibility; (d) cloud-region data residency for adequacy; (e) Section 26 contract clauses adapted for cloud terms. (9) Vendor Due Diligence: (a) security questionnaire + SOC 2 + ISO 27001 review; (b) financial stability; (c) reputational; (d) jurisdiction + legal regime; (e) sub-processor chain; (f) DPIA Section 34 if high-risk. (10) Penalties: (a) Section 50 administrative penalties for joint controller + processor failures; (b) Section 26 contract absence is administrative violation; (c) controller liable for processor breaches in some circumstances. Coordinates with EU GDPR Articles 26 + 28 + 30 + UK DPA 2018 + Convention 108+ + EDPB Guidelines on Controllers and Processors + ISO/IEC 27701 + Jamaica Section 22 Privacy Notice + Section 27 Transfers + Section 28-30 Breach + Section 34 DPIA + Section 35 Security. Jamaica DPA 2020 Sections 24-26 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.