· amendment, blocking, erasure or destruction as necessary to correct the inaccuracy.
A request made under section 6 of DPA 2020 must generally be answered promptly and, in any event, within thirty days after the data controller has both the request and any applicable fee. A notice requiring cessation of processing under section 11 must generally be answered within twenty-one days, and a rectification request under section 13 must generally be addressed within thirty days.
15. How to Exercise Your Rights
A data subject may submit a written request to exercise any applicable right under DPA 2020. Data Defense Consulting may request sufficient information to verify identity and locate the relevant personal data before acting on the request, as permitted by the Act.
Requests should clearly describe the right being exercised and the personal data or processing activity concerned. Where Data Defense Consulting cannot comply fully with a request, it will provide the reasons to the extent required by law, including identifying the relevant legal basis for refusal where applicable.
16. Children and Persons Acting for Others
Where a data subject is a minor or otherwise unable to act, DPA 2020 allows certain rights to be exercised by a parent, legal guardian, nearest relative, legal personal representative or another properly authorised person in the circumstances set out in the Act.
Data Defense Consulting may require documentary proof of authority before accepting such a request.
17. Complaints and Regulatory Contact
If a data subject believes that Data Defense Consulting has processed personal data unlawfully or failed to comply with DPA 2020, the person may first contact Data Defense Consulting so that the matter may be reviewed internally.
A data subject may also make an application or complaint to the Office of the Information Commissioner (OIC), which is the independent body established under DPA 2020 to monitor compliance with the Act and promote good practice
18. Data Protection Officer and Contact Details
Data Defense Consulting will maintain a contact point for privacy and data protection matters and, where required by DPA 2020, appoint a Data Protection Officer
Contact details for privacy requests and complaints:
Data Defense Consulting
Attn: Privacy / Data Protection Contact
Kingston, St. Andrew, Jamaica
Email: [insert privacy email address]
Telephone: [insert telephone number]
If Data Defense Consulting has appointed a Data Protection Officer, the contact details above may be used to contact that officer unless a different contact is separately notified.
19. Cookies and Website Data
Where Data Defense Consulting operates a website, the website may collect limited technical data such as IP address, browser type, device information, pages viewed and related usage data for security, functionality, analytics and service improvement purposes
Where cookies or similar technologies are used in a manner that engages DPA 2020 obligations, Data Defense Consulting will provide appropriate notice and, where required, obtain valid consent
20. Data Breaches
Data Defense Consulting will maintain procedures for identifying, containing, assessing and managing personal data breaches. Where required by DPA 2020 or applicable regulations, Data Defense Consulting will notify affected data subjects and/or the Information Commissioner
21. Registration and Compliance Governance
Where required by DPA 2020, Data Defense Consulting will maintain registration as a data controller with the Information Commissioner and will comply with applicable governance obligations, including the maintenance of compliance measures and any required assessments or filings
22. Changes to This Policy
Data Defense Consulting may update this Privacy Policy from time to time to reflect changes in law, regulation, guidance, technology, business operations or risk. The latest version will be made available through the relevant communication channel or website and will take effect from the stated effective date
23. Important Implementation Note
This document is a general external-facing Privacy Policy. To achieve fuller operational compliance with DPA 2020, Data Defense Consulting should also maintain supporting internal documents and controls, including as applicable:
· a data protection policy;
· records of processing activities;
· retention and disposal schedules;
· breach response procedures;
· data subject rights handling procedures;
· direct marketing consent and opt-out procedures;
· processor/data-sharing agreements;
· employee confidentiality and acceptable use obligations; and
· data protection impact assessments where required
