Cybersecurity law & regulation in Cayman Islands (2026)

Legal framework

CIMA Rule & Statement of Guidance – Cybersecurity for Regulated Entities (financial sector); Data Protection Act (2021 Revision) enforced by the Ombudsman; Computer Misuse Act (2015 Revision) for cybercrime. No horizontal NIS-style law.

Key points: cybersecurity in Cayman Islands

1. 01CIMA Cybersecurity Rule (financial sector)

   CIMA's binding Rule and Statement of Guidance on Cybersecurity for Regulated Entities came into force on 27 November 2020 and applies to all CIMA-licensed/registered entities (banks, insurers, funds, investment managers, VASPs). Entities must maintain a documented cybersecurity framework to identify, monitor and mitigate cyber risks, with breach potentially triggering fines or regulatory action.

   cima.ky cima.ky

2. 0272-hour CIMA incident notification

   Regulated entities must notify CIMA in writing no later than 72 hours after discovering a cyber incident deemed to have — or potentially become — material impact (e.g. significant operational disruption, customer impact, or compromise/loss of sensitive information).

   cima.ky ogier.com

3. 03Data Protection Act breach notification

   Under the Data Protection Act (in force 30 September 2019), data controllers must notify the Ombudsman and affected individuals of a personal data breach without undue delay and no later than 5 days after they should have become aware. Failure is an offence; fines up to KYD 250,000 and/or imprisonment are available for specified contraventions.

   ombudsman.ky dlapiperdataprotection.com

4. 04Cybercrime — Computer Misuse Act

   The Computer Misuse Act (2015 Revision), modelled on the UK's Computer Misuse Act 1990, criminalises unauthorised access, unauthorised modification, unauthorised interception and denial-of-service style acts. Provisions are extraterritorial where Cayman computer systems are affected.

   legislation.gov.ky

5. 05National CSIRT and Cyber Safe Campaign

   A national Computer Security Incident Response Team (CSIRT.KY) was launched in 2022 within the Ministry responsible for e-government to coordinate incident response for government, business and citizens, complemented by the government's Cyber Safe Cayman awareness campaign.

   cybersecurityadvisors.network cybersecurityintelligence.com

6. 062026 outlook — VASP and tokenised fund cyber rules

   CIMA's updated regime (February 2026) tightens cybersecurity, risk-assessment and internal-control obligations for Virtual Asset Custodians and Virtual Asset Trading Platforms; tokenised fund offering documents must now disclose cybersecurity and transferability risks and mitigations. Further rulemaking on cyber-risk management, technology governance and senior-management accountability is anticipated.

   practiceguides.chambers.com conyers.com

Timeline of decisions

1. 1 Nov 2025Guidance · official
   CIMA publishes Desk-Based Review of registered VASPs flagging cyber gaps

   CIMA's thematic review of 11 virtual asset service providers (assessed Sept 2024-Feb 2025) found that 82% lacked cybersecurity insurance, 27% had not appointed a qualified CISO/CIO, and many had inadequate custody, wallet and private-key controls. It signals heightened cyber-supervisory scrutiny of the crypto sector.

   CIMA

2. 1 Jun 2023Guidance · official
   CIMA issues Thematic Cybersecurity Review Report

   CIMA reviewed 12 banking, insurance and securities entities and concluded the 2020 cybersecurity guidance had largely been adopted, while flagging weaknesses in risk assessment and oversight of outsourced providers (notably Microsoft 365/Azure dependencies). The report sets supervisory expectations for the sector.

   CIMA

3. 14 Apr 2023Law
   CIMA updates Cybersecurity Rule and Statement of Guidance

   Updated binding Rule and SOG on Cybersecurity for Regulated Entities took effect, expressly extending obligations to virtual asset service providers and SIBA-registered persons while extending the cybersecurity/outsourcing exemption from mutual funds to private funds. It broadened the perimeter of regulated entities subject to mandatory cyber-risk management.

   Ogier

4. 1 May 2020Law · official
   CIMA issues binding Rule and SOG on Cybersecurity for Regulated Entities

   CIMA introduced its first dedicated, binding cybersecurity framework requiring regulated entities to adopt a board-approved cyber risk strategy, security policies and controls, and to notify CIMA of material cyber incidents within 72 hours. This established the financial sector's core cybersecurity obligations.

   CIMA

5. 1 Jan 2015Law · official
   Computer Misuse Law (2015 Revision) consolidates core cybercrime offences

   The consolidated Computer Misuse Law, modelled on the UK Computer Misuse Act, criminalises unauthorised access, modification, interception, obstruction and disclosure of access codes, with extra-territorial reach. It is the foundational anti-hacking statute underpinning the islands' cybersecurity legal framework.

   OfReg (Cayman Islands)

Sources

1. 1.cima.ky/upimages/regulatorymeasures/Rule-CybersecurityforRegulatedEntities_16
2. 2.cima.ky/upimages/regulatorymeasures/SOG-CybersecurityforRegulatedEntities_168
3. 3.ombudsman.ky/data-protection-organisation/personal-data-breaches
4. 4.ombudsman.ky/data-protection
5. 5.legislation.gov.ky/cms/images/LEGISLATION/PRINCIPAL/2000/2000-0008/2000-0008_2015%20Revi
6. 6.ogier.com/news-and-insights/insights/cybersecurity-cima-releases-updated-rule-a
7. 7.dlapiperdataprotection.com/index.html?t=breach-notification&c=KY
8. 8.practiceguides.chambers.com/practice-guides/blockchain-crypto-assets-2026/cayman-islands
9. 9.conyers.com/publications/view/regulatory-risk-advisory-review-cayman-islands-janu
10. 10.cybersecurityadvisors.network/2025/02/17/cybersecurity-developments-in-the-caribbean-regional-colla
11. 11.cybersecurityintelligence.com/location/cayman-islands/