In July, the Information Commissioner told Parliament's Public Accounts Committee that her office needs about two more years before it can fully enforce the Data Protection Act, 2020 — putting full enforcement in 2028. Registration for data controllers was also paused from 1 December 2025 while the Office upgraded its systems.
It would be easy to read this as a reprieve. It is not. The Act is law, and organisations handling personal data must comply with it now. What the delay offers is time: time to fix the gaps before anyone comes asking.
Where screening programmes still fall short
We first wrote about the DPA and background screening in April 2025. Since then, the same four gaps keep appearing.
Consent is bundled. Screening consent is still buried in a general job application. Candidates should receive a separate, plain-language form that explains what will be checked, who will see it and how long it will be kept.
Sensitive data has no special handling. Criminal record, financial and health information sit in the same HR folder as everything else. The Act sets a higher bar for these categories, and organisations processing them are among those required to appoint a Data Protection Officer.
Files never leave. Screening results for unsuccessful candidates, and for staff who left years ago, are kept indefinitely. Data should be kept only as long as it is needed for the purpose it was collected for.
Nobody owns it. HR assumes IT is handling data protection; IT assumes legal is. Without a named owner, nothing gets reviewed.
It is not only screening
Security operations hold more personal data than most organisations realise. Visitor logs, access card records, guard occurrence books and CCTV footage all identify individuals. Each needs a clear purpose, controlled access and a retention period. CCTV footage in particular is often kept far longer than any security reason requires — or overwritten before it can be used in an investigation. Neither is defensible.
What this means in practice
- Confirm whether your organisation is registered with the Office of the Information Commissioner, and diarise renewal.
- Decide whether you need a Data Protection Officer, and name one if you do.
- Separate screening consent from the job application.
- Set and enforce a retention period for screening files, visitor logs and CCTV footage.
- Restrict who can view screening results, and keep a record of who has.
Two years is enough time to do this properly, without disrupting hiring or operations. It is not enough time if you start in 2028.
Talk to us about a DPA-ready screening process. → Background checks
Sources: Jamaica Gleaner, 30 July 2026.
