Compliance FrameworksAmericas
Cayman Islands Data Protection Act 2017
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | KY DPA |
| Region | Americas |
| Country or scope | Cayman Islands |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers KY DPA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
KY-DPA-P7 Seventh Principle: Security | Appropriate technical and organisational measures must be taken against unauthorised or unlawful processing and against accidental loss, destruction, or damage, including integrity of processing systems (DPA (2021 Revision) Sch. 1, seventh data protection principle) | Scan |
KY-DPA-P4 Fourth Principle: Accuracy | Personal data must be accurate and, where necessary, kept up to date, which requires precise version tracking of the software maintaining records (DPA (2021 Revision) Sch. 1, fourth data protection principle) | Scan |
KY-DPA-PROC Processor Contracts | Processing by a data processor must be under a written contract requiring equivalent security measures, so the suppliers of processing components must be identified (DPA (2021 Revision), processor provisions under the seventh principle) | Scan |
KY-DPA-BREACH Breach Notification Readiness | Personal data breaches must be notified to the Ombudsman and affected data subjects, which requires identifying exactly which components were affected (DPA (2021 Revision), personal-data-breach notification duty) | Scan |
KY-DPA-INV Accountability for Processing | Controllers are responsible for compliance with the principles for all processing under their control, presupposing an inventory of processing components (DPA (2021 Revision), controller responsibility) | Scan |
KY-DPA-DOC Fair and Transparent Processing Documentation | The first principle's fair-processing requirements imply documented, identifiable records of how and where data is processed (DPA (2021 Revision) Sch. 1, first data protection principle) | Scan |
Policy templates
All 22 from the standard set, adapted to KY DPA.