Jamaica’s Data Protection Act, 2020 (DPA) changed the ground rules for how organisations collect, store, and use personal information — and background screening sits right at the centre of that. If your screening process hasn’t been reviewed since the Act came into force, there’s a good chance it has gaps.
Consent has to be informed, not implied
A signature on a job application no longer covers everything. Candidates need to understand what will be checked, who will see the results, and how long the information will be retained. We recommend a standalone consent form for screening, separate from the general application, written in plain language.
Sensitive personal data needs a higher bar
Criminal history, financial standing, and health-related information are treated as sensitive categories under the Act. Processing them requires a clear lawful basis and proportionate safeguards — not just internal policy, but documented controls: who can access the file, how it’s stored, and when it’s destroyed.
Retention needs an end date
A common gap we find: screening files kept indefinitely, long after a hiring decision is made or a candidate is rejected. The DPA expects data to be kept no longer than necessary for the purpose it was collected for. We help clients set a retention schedule and actually action it, rather than letting files accumulate by default.
What this means in practice
- Separate, specific consent for screening — not bundled into a general application form
- A documented lawful basis for processing sensitive categories
- Defined access controls for who can view screening results
- A retention schedule with an enforced deletion point
None of this requires slowing down your hiring process. It requires making the existing process defensible — which, in our experience, also makes it more consistent and easier to manage.
