1. Overview
The Digital Jamaica Platform, powered by the Atlas AI Platform and operated by Intellibus Jamaica LTD LLC, is committed to protecting personal data and upholding the highest standards of information governance.
This policy outlines how we comply with the Data Protection Act of Jamaica (2020) and the World Digital Governance (WDG) PROSE Standards — ensuring that every citizen's, partner's, and employee's data is collected, processed, and stored lawfully, fairly, and securely.
2. Our Commitment
We believe data protection is digital sovereignty.
Every piece of personal or public data entrusted to Digital Jamaica is managed responsibly, transparently, and in the best interest of Jamaica's citizens.
We ensure that:
- Personal data is used only for legitimate, clearly defined purposes.
- Data is not disclosed or transferred without proper authorization.
- Systems are secure, auditable, and designed for privacy by default.
- Every person has rights over their own data.
3. Legal Framework
Our operations are governed by:
- The Data Protection Act (2020) of Jamaica
- The Electronic Transactions Act (2006)
- The Access to Information Act (2002)
- Relevant international data privacy principles (OECD, CARICOM, and WDG PROSE)
4. Data Protection Principles
We apply the Eight Data Protection Principles established in Jamaica's law and WDG standards:
| # | Principle | Meaning |
|---|---|---|
| 1 | Lawfulness, Fairness & Transparency | Personal data is processed fairly, for lawful purposes, and individuals are informed of its use. |
| 2 | Purpose Limitation | Data is collected for specific purposes and not reused in incompatible ways. |
| 3 | Data Minimization | Only necessary data is collected for the stated purpose. |
| 4 | Accuracy | Data is kept accurate and up to date. |
| 5 | Storage Limitation | Data is retained only as long as needed. |
| 6 | Integrity & Confidentiality | Data is secured against loss, misuse, or unauthorized access. |
| 7 | Accountability | Intellibus Jamaica LTD LLC is accountable for compliance. |
| 8 | Rights of Data Subjects | Every individual has the right to access, correct, and control their data. |
5. Scope
This policy applies to:
- All systems, databases, dashboards, and mobile apps operated by Intellibus Jamaica LTD LLC under the Digital Jamaica 2035 WDG Initiative.
- All staff, contractors, ministries, and partner agencies who access or process data through the Atlas Coordination Platform.
- All citizens, volunteers, and organizations contributing or submitting data to the platform.
6. Categories of Data We Process
| Type | Description | Examples |
|---|---|---|
| Personal Data | Information relating to an identifiable individual | Name, ID number, phone, email, GPS location |
| Operational Data | Data used for logistics and coordination | Project updates, delivery logs, fleet data |
| Public Sector Data | Government project and aid data | Budget, disbursement, ministry status reports |
| Analytical Data | Aggregated non-personal statistics for reporting | Job creation, aid impact, education metrics |
| Sensitive Data | Collected only under lawful basis | Health-related information in emergency response |
7. Roles & Responsibilities
| Role | Responsibility |
|---|---|
| Data Controller | Intellibus Jamaica LTD LLC — determines purpose & means of processing |
| Data Processor | Atlas Platform operations team — processes data under controller's instruction |
| Data Protection Officer (DPO) | Ensures compliance, manages requests, reports to leadership & ICO Jamaica |
| Authorized Users | Must handle data per training & confidentiality agreements |
| Partner Agencies | Must sign Data Processing or Sharing Agreements with clear retention & security clauses |
8. Data Security Measures
We employ advanced safeguards to ensure data confidentiality, integrity, and availability:
- Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256).
- Access Controls: Role-based permissions and MFA for all accounts.
- Audit Trails: Every access and data modification logged via Atlas Ledger.
- Monitoring: 24/7 anomaly and intrusion detection using AI analytics.
- Hosting: Certified cloud infrastructure (ISO/IEC 27001 & 42001).
- Business Continuity: Redundant data centers and disaster recovery plans.
9. Data Subject Rights
Under the Data Protection Act (2020), every data subject has the right to:
- Access their personal data.
- Request correction of inaccurate or incomplete data.
- Request deletion when no longer needed.
- Object to data being used for non-essential purposes.
- Withdraw consent at any time (where applicable).
- Lodge a complaint with the Information Commissioner's Office (ICO Jamaica).
Requests may be made via email to the Data Protection Officer (contact below).
11. Data Retention & Disposal
Data is retained for the minimum time necessary to meet operational, legal, and audit requirements. Upon expiration, it is securely deleted, anonymized, or archived according to the Government of Jamaica Records Retention Schedule.
12. Breach Notification
In case of a personal data breach:
- We will notify the Information Commissioner within 72 hours.
- Affected individuals will be informed if the breach poses a high risk to their rights.
- A full investigation and mitigation plan will be logged and tracked via the Atlas Incident Register.
13. Training & Awareness
All Intellibus Jamaica staff, contractors, and partner representatives receive annual Data Protection & Cybersecurity Training, including:
- Data handling procedures
- Confidentiality obligations
- Incident reporting protocols
- Ethical AI & digital governance
14. Accountability & Auditing
We conduct regular internal audits and annual WDG compliance reviews to verify adherence to:
- Jamaica's Data Protection Act (2020)
- ISO/IEC 27001 Information Security
- ISO/IEC 42001 AI Management
- WDG PROSE framework (Policy, Regulation, Ontology, Standards, Ethics)
Audit summaries are published on public.wdg.org for transparency.
15. Contact Information
Data Protection Officer (DPO)
Summary
Intellibus Jamaica LTD LLC operates under Jamaica's Data Protection Act (2020) and WDG PROSE standards. Your data is protected, encrypted, and used only for legitimate public-interest purposes.