Most of the data Jamaicans generate is stored and processed abroad, under foreign law, by companies that use it to build AI products. I sit on Jamaica's National AI Task Force, and the gap I see from the inside is speed: government moves in years, and the AI systems learning from our data change every few months. This piece sets out what data sovereignty means in practice, where Jamaica's law already covers it and where it does not, and what the government, businesses and CARICOM should do in the next 12 to 24 months.
Data sovereignty means Jamaican law decides how Jamaican data is used
Data sovereignty is the principle that data generated in a country is governed by that country's laws. A doctor's visit, a loan application, a phone top-up and a supermarket purchase all create data. The practical questions are who stores it, who may use it, and who earns from it.
For Jamaica today, the answer is mostly foreign companies. A Facebook user's activity is stored on servers abroad and processed under US law. A business on Google Cloud keeps its records in data centres the company controls. A hospital using a foreign electronic records system sends patient data out of Jamaican jurisdiction.
This is the normal result of a small country buying technology built elsewhere. AI raises the stakes, because these systems do more than store data: they learn from it and make decisions with it.
Four ways AI changes the stakes
- Data becomes decisions. A diagnostic model trained mainly on North American or European patients can be wrong for Jamaican ones. Dermatology models have been documented performing worse on darker skin, which is the risk in plain view.
- Data becomes revenue abroad. The search queries, purchases and messages Jamaicans produce help train models worth billions of dollars. None of that value returns here.
- Systems become dependencies. If a bank's credit models or a ministry's case system runs on a foreign AI service, a price rise, a change of terms or a sanctions decision can disrupt it, and Jamaica may have no fallback.
- Auditing gets harder. A regulator cannot check a model for bias against Jamaicans if it cannot see how the model was trained or tested.
What Jamaica's Data Protection Act already covers
Jamaica passed the Data Protection Act in 2020, and it came fully into force in December 2023. It is more substantial than many people assume. It sets standards for collecting, processing and storing personal data, gives individuals rights of access and correction, and is enforced by the Office of the Information Commissioner.
Two features matter for AI. The Act gives people rights in relation to decisions taken solely by automated means, and it allows the Commissioner to impose fines of up to 4 percent of an organisation's annual worldwide turnover for serious breaches, the same ceiling as GDPR's top tier.
What it does not address is how AI is built. There are no specific rules on using Jamaican personal data to train models, no requirement to test a system for bias against Jamaican populations before it is deployed, and no duty to explain an automated decision in plain language. Those are the gaps to close.
What Jamaica can borrow from the EU
The EU has two instruments worth studying. GDPR, in force since 2018, covers personal data generally. The EU AI Act, which entered into force in August 2024 and is being phased in, adds rules for AI systems by risk level.
| Provision | EU | Jamaica today |
|---|---|---|
| Rights over solely automated decisions | Yes (GDPR Article 22) | Yes, in the Data Protection Act |
| Data portability between services | Yes | Not a stated right |
| Privacy by design | Required | Implied by security standards, not spelled out |
| Risk-based rules for AI systems | Yes (AI Act) | None |
| Maximum fine | 4% of worldwide turnover (GDPR) | 4% of worldwide turnover |
Copying the EU wholesale would be a mistake. The Commissioner's office is small, and an AI Act-style conformity regime would swamp it. The useful parts are the risk tiers (so that a credit or health model gets more scrutiny than a chatbot) and the duty to document how a high-risk system was tested.
Caribbean data that global rules overlook
Four kinds of data matter more here than in the countries that write most AI policy:
- Tourism data. Booking.com, TripAdvisor, Airbnb, Expedia and foreign airlines hold most of the record of who visits Jamaica, what they spend and what they complain about. The Jamaica Tourist Board sees a fraction of it.
- Diaspora data. About three million Jamaicans live abroad, more than live on the island. Their remittance and travel patterns sit with foreign banks, money transfer firms and platforms.
- Climate and environmental data. Hurricane, rainfall and sea-level models depend on data that is often held or processed by foreign agencies and firms.
- Agricultural data. Soil, yield and pest records are either not collected systematically or collected by foreign agritech companies.
None of this means the data must move home. It means Jamaica should negotiate access to aggregated versions of it, for planning and research, as a condition of doing business.
Dependency is the risk to plan against
Picture Jamaica in 2030 with bank credit scoring, hospital diagnostics, customs risk screening and school tutoring all running on AI services from different foreign providers. Each works well until one of them raises prices, is acquired, changes its terms or is caught in a sanctions dispute.
Rejecting foreign AI would be a mistake; the tools are good and building equivalents locally is not realistic for general-purpose models. The sensible line is to keep control of the data and the decision logic in a few sectors (health, finance, government records and education) and use global services freely elsewhere. Every contract in those sectors should have a data export clause and an exit plan.
Why CARICOM has to act as a bloc
Jamaica has 2.8 million people, Barbados about 280,000 and Dominica about 72,000. On their own, none has much weight with companies whose market value exceeds their GDP. CARICOM together has around 18 million people and a combined GDP of over US$80 billion.
The Caribbean Single Market and Economy already provides machinery for regional economic rules. A shared CARICOM position on AI and data would let member states set one standard for data transfers and model testing, so that a provider meets it once for the whole region. The weakness in my own argument is that CARICOM has struggled to implement far simpler harmonisation, such as free movement of skilled workers, and a data framework could take just as long.
What Jamaica's government, businesses and CARICOM should do in the next 24 months
- Ministry responsible for data protection: amend the Data Protection Act for AI training and testing. Start with a consultation paper on three additions: rules for using personal data to train models, pre-deployment bias testing for high-risk uses, and plain-language explanations of automated decisions.
- Finance ministry: fund AI expertise in the Office of the Information Commissioner. Hire or second at least two technical staff who can read a model's documentation and test it.
- Procurement officers in health, finance and government records: add data clauses to every AI contract. Require data storage locations to be named, an export format on exit, and the right to audit how the system was tested.
- Business owners: map what data you send to AI services this month. List each tool, what goes into it and where the provider stores it, then switch off model training on your data where the provider allows it.
- CARICOM Secretariat and member governments: draft a common data transfer and model testing standard. Begin with the health and financial sectors, where regulators already cooperate.
- Universities and training providers: build local technical capacity. Sovereignty over data is empty without people who can build and audit systems. I have run free weekly AI training for seven years and founded four AI labs in Jamaica because this is the slowest part to fix.
AI prompt templates you can use today
I am a policymaker in [CARIBBEAN COUNTRY] working on AI data governance. Draft a policy brief of under 2,000 words covering: data sovereignty principles for small island developing states, a comparison with GDPR and the EU AI Act, specific provisions for AI training data, and implementation steps that fit a regulator with fewer than 20 staff.
I run a business in Jamaica that uses AI services from [PROVIDER NAME]. Help me audit my data exposure: what data I send to this provider, where it is stored, whether it is used to train models and how to switch that off, what rights I and my customers have under Jamaica's Data Protection Act, and what happens to my data if the provider changes terms or is acquired.
Explain data sovereignty to a non-technical Jamaican audience in under 500 words. Use examples from tourism, health records, banking and farming, and end with three things an ordinary person can check about the apps they use.
Outline a CARICOM framework for AI data governance. Cover the components it needs, the main obstacles to regional agreement, what to take and what to leave from the EU approach, and a realistic timeline given the differences in digital infrastructure between member states.
Frequently Asked Questions
Who enforces Jamaica's Data Protection Act, and how do I complain?
The Office of the Information Commissioner (OIC) enforces the Act. An individual who believes an organisation has misused their personal data should first ask the organisation directly, in writing, for access to or correction of the data, and keep a copy. If that fails, a complaint can be made to the OIC, which publishes its contact details and guidance on its website.
Do Jamaican organisations have to register with the Information Commissioner?
Yes, the Act requires data controllers to register with the Information Commissioner, subject to any exemptions in the regulations. Many organisations also need to appoint a data protection officer. Check the OIC's current guidance for registration fees, deadlines and which organisations are covered, as these are set by regulation and can change.
Does using ChatGPT or Claude at work send data out of Jamaica?
Yes. These models run on the provider's servers abroad, so anything you paste or upload is transferred and processed there. Business and enterprise plans usually exclude your data from model training by default, while some consumer plans let you opt out in settings. Do not put customer personal data into any AI tool until you have checked the provider's data terms and whether your use fits the Data Protection Act's rules on transfers outside Jamaica.
Is data localisation the same as data sovereignty?
No. Localisation means data must be physically stored inside a country or region. Sovereignty is broader: it means local law governs how data is used wherever it sits, which can be achieved through contracts, audit rights and transfer rules. Strict localisation is expensive for a small country, so most small states use it only for the most sensitive categories, such as health and government records.
What is Adrian Dunkley's role in Jamaica's AI policy?
He is a member of Jamaica's National AI Task Force, the Government of Jamaica body advising on national AI policy, including data governance. The views in this article are his own. Official positions are published by the government, not by individual task force members.