Data protection & privacy law in Cayman Islands (2026)
Data protection in Cayman Islands: comprehensive law.
The Cayman Islands has a comprehensive, GDPR-style data protection regime under the Data Protection Act, 2017 (now the 2021 Revision), which came into force on 30 September 2019. The Office of the Ombudsman is the supervisory authority, with powers to investigate complaints, order corrective action and impose monetary penalties. The law applies to data controllers established in the Cayman Islands and to those processing personal data in the jurisdiction.
Legal framework
Data Protection Act (2021 Revision), enforced by the Office of the Ombudsman (Cayman Islands)
Key points: data & privacy in Cayman Islands
Governing law
The Data Protection Act, 2017 was brought into force on 30 September 2019 and is now consolidated as the Data Protection Act (2021 Revision). It sets out eight data protection principles broadly modelled on the EU GDPR.
Supervisory authority
The Office of the Ombudsman is the independent regulator responsible for enforcing the Act, handling complaints, conducting investigations, and issuing guidance to data controllers and the public.
Data subject rights
Individuals have the right to be informed, to access their personal data, to have inaccurate data rectified, to stop or restrict processing (including for direct marketing), to object to automated decision-making, and to complain to the Ombudsman.
Breach notification
Controllers must notify the Ombudsman and affected individuals of a personal data breach without undue delay and no later than 5 days after becoming aware of it.
International transfers
Under the eighth data protection principle, personal data may only be transferred to jurisdictions that ensure an adequate level of protection for the rights and freedoms of data subjects (or where a listed derogation applies).
Enforcement and penalties
The Ombudsman may issue information orders, enforcement orders, and monetary penalty orders of up to CI$250,000 for serious contraventions. Non-compliance with information or enforcement orders is an offence carrying fines up to CI$100,000 and/or up to five years' imprisonment.
Timeline of decisions
- Enforcement · officialOmbudsman issues enforcement decision against WORC
The Ombudsman issued a data-protection enforcement decision involving Workforce Opportunities & Residency Cayman (WORC), part of a growing body of published case outcomes that show the regulator actively applying the DPA to government bodies.
Cayman Islands Ombudsman
- Enforcement · officialFirst high-profile enforcement order: Department of Agriculture
The Ombudsman ordered the Department of Agriculture to stop collecting unnecessary personal data from retail customers, delete data held without a legal basis, and provide a privacy notice, one of the first publicly reported enforcement orders under the DPA.
Cayman Islands Ombudsman
- Guidance · officialGuide for Data Controllers takes effect
The Ombudsman issued its consolidated Guide for Data Controllers, the principal practical guidance explaining how organisations must comply with the DPA's data-protection principles and obligations.
Cayman Islands Ombudsman
- Law · officialData Protection Act (2021 Revision) consolidated
The 2017 law was re-issued as the Data Protection Act (2021 Revision), the current consolidated statute incorporating amendments and standardising terminology from 'Law' to 'Act'.
Cayman Islands Ombudsman / Legislation
- Guidance · officialGuidance on Monetary Penalty Orders published
The Ombudsman published guidance on monetary penalty orders, explaining the criteria for imposing fines of up to CI$250,000 for serious contraventions likely to cause substantial damage or distress to data subjects.
Cayman Islands Ombudsman
- Law · officialData Protection Law and Regulations come into force
The DPL 2017 and the supporting Data Protection Regulations (SL 17 of 2019) took effect, establishing the Cayman Islands' first comprehensive, GDPR-aligned data-protection regime governing both public and private sectors, enforced by the Ombudsman.
Cayman Islands Ombudsman
- Law · officialData Protection Act enters into force
The DPA 2017 commenced together with the Data Protection Regulations 2018, introducing GDPR-style rights including the right not to be subject to solely automated decisions producing significant effects. It remains the primary statute applied to AI-driven personal-data processing pending dedicated AI law.
Cayman Islands Legislation Portal
- DecisionGovernment postpones commencement to September 2019
The Government postponed the law's start from the originally envisaged January 2019 to 30 September 2019, after the financial-services industry sought more time to prepare and to allow a public-education campaign.
Broadhurst LLC
- Law · officialData Protection Law, 2017 published in Official Gazette
The Data Protection Law, 2017 (Law 33 of 2017) was published in the Official Gazette, formally placing the GDPR-modelled framework on the statute book ahead of its later commencement.
Cayman Islands Ombudsman / Legislation
- Law · officialData Protection Law and Ombudsman Law passed by Legislature
The Legislative Assembly passed the Data Protection Law, 2017 and the Cayman Islands Ombudsman Law, 2017 (Law 23 of 2017), the latter creating a unified Ombudsman office and designating it the supervisory authority for data protection.
Cayman Islands Legislation
Sources
Next for Cayman Islands: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 21 Aug 2026. Methodology & how to cite · State of Technology Regulation 2026