Customer and employee data under the Data Protection Act

What the Act is about

The Data Protection Act 2020 regulates the processing of personal data about individuals in Jamaica. A customer's name and phone number, an employee's TRN and salary and a job applicant's CV are all personal data. The Act places duties on the organisations that decide why and how such data is used and gives individuals rights over it.

The Information Commissioner oversees compliance. Because the Act has transition arrangements and regulations that develop over time, do not rely on an old summary; read the current guidance from the Commissioner's office or ask an attorney-at-law how it applies to your sector.

For a clinic, the data may be sensitive: names, phone numbers and health notes. Even a small practice needs to separate those records from marketing contacts, limit access to those who treat the patient and decide how long old files are kept. The more sensitive the data, the stronger the case for formal safeguards.

Map the data you hold

Begin with a simple inventory: which systems and files contain personal data, what kinds, whose, where they are stored and who has access. A salon may find customer numbers in a booking notebook, a phone, a spreadsheet and a messaging app, and nobody has the full picture.

Once the inventory exists, decisions get easier. You can decide which copies to delete, which system becomes the single source of truth and which employees genuinely need access. An inventory also helps if a customer asks what you hold about them.

Retention is a decision, not an accident. Write down how long you keep customer records, employee files and CCTV recordings, and delete or archive them when the period ends. Data kept forever becomes a liability when a device is stolen.

Collect only what you need, and say why

Ask customers only for details you will use. A tyre shop needs a phone number to call about a finished job; it does not need a date of birth. Tell people at the point of collection what the data is for and how long you will keep it, in plain words on the form or at the counter.

Employee data deserves the same discipline. Salary, bank details and medical information should be visible to payroll and management only. Keep applicant CVs for a defined period, then delete them.

Suppliers and service providers who process data for you, such as a payroll bureau or an email platform, should be bound by written terms about confidentiality and security. Ask where they store the data and whether they use sub-processors.

Marketing messages and consent

Messages sent to customers for marketing should rest on a clear basis, usually their agreement, and every recipient should have an easy way to say stop. Keep a list of people who opted out and check each campaign against it before sending.

Keep a record of when and how each person agreed. A screenshot of a verbal request is not evidence; a dated line in the customer record is. Because the rules for electronic marketing can be refined, confirm current requirements with your adviser before launching a campaign.

Be ready for requests from individuals. Someone may ask what you hold about them, ask for a correction or ask you to stop using their data. Decide who receives such requests, how identity is checked and how quickly you will reply, and write the steps into a short procedure.

Security and tools

Basic security prevents most incidents: unique passwords, two-step verification, screen locks, encrypted backups and removal of access on the day a person leaves. Data on lost phones and unprotected spreadsheets is the typical source of a breach in a small business.

4softcrm stores contacts, leads and deals in one place, with e-mail and SMS sent from the contact record. 4notify sends the messages you write. 4hosting provides web hosting and VPS in EU data centres. None of them makes you compliant by itself; they help you control where data sits, while the legal assessment stays with you and your adviser.

If personal data is lost or exposed, act quickly: contain the incident, find out what was affected, tell the people concerned where appropriate and consider whether the Information Commissioner must be notified. Ask your attorney for the current notification rules now, not during an incident.

A first-month action plan

In the first week, draw up the data inventory and name someone responsible for data protection, even if it is only part of their job. In the second, remove personal data from places it should not be: old phones, shared drives open to everyone and spreadsheets attached to email threads.

In the third week, review the forms and messages that collect data. Add a short, clear notice saying why you collect it, how it is used and how to contact you. Check marketing lists and remove people who opted out or never agreed.

In the fourth week, tighten security: unique passwords, two-step verification on email and cloud accounts, encrypted laptops and a rule about leaving the company. Brief staff in a short session and record who attended. Revisit the plan every six months, or whenever you launch a new system or service that uses customer data.

Remember that good data habits also help the business commercially. Customers trust companies that handle their details carefully, larger clients increasingly ask suppliers about data security in tenders, and an organised database makes marketing, service and collections more effective. Treat compliance as part of quality management rather than a separate legal chore, and review it whenever you adopt a new tool or enter a new market.

It applies to organisations that process personal data, whatever their size, subject to the exemptions and transition rules in the legislation. If you keep customer contacts or employee files, you are likely in scope. Check the Information Commissioner's guidance or ask an attorney-at-law for your sector.

The Information Commissioner oversees compliance with the Data Protection Act 2020, issues guidance and handles complaints. The office publishes information for organisations and individuals, which is the best place to check current obligations and any new regulations.

Only where you have a proper basis, normally the customer's agreement, and you must honour opt-outs promptly. Keep a record of consent and an up-to-date stop list. Confirm the latest rules for electronic marketing with your adviser before sending a campaign.

No tool does that on its own. 4softcrm helps you keep contacts, leads and deals in a single controlled place, which supports good practice, but compliance depends on your policies, consent records, security and how you respond to people's requests. Seek legal advice for your own situation.

Information page

This page is informational. Confirm requirements with the competent authority; 4b2b tools cover general invoicing and records only.