Coverage in the run-up to the data-controller registration deadline was blunt: register, and be able to show what you do with personal data. Practitioners quoted in the Jamaica Observer pushed the same point that regulators had been making since the grace period — the form is not the programme.
The firms that handled it well had three things ready before they filed. A processing inventory that named every system holding personal data. A retention rule for each of those systems, written down and actually applied. And a breach procedure with a named person, a timeline and a rehearsal.
The firms that struggled had none of those and discovered the gap when a customer asked for a copy of their data. Subject access requests are the quiet enforcement mechanism of the Act: they cost nothing to make and they expose immediately whether an inventory exists.
For most Jamaican organisations this is a two- to three-month exercise with a local specialist. Where a group parent imposes its own privacy standard on top of the Act, a network firm's privacy practice is the safer choice.