Who needs to be notified of a data breach?

Under the Cayman Islands Data Protection Act, you must notify the Ombudsman (the supervisory authority for data protection) and all affected individuals whose personal data has been compromised. If the breach also affects data subjects in other jurisdictions, you may need to notify overseas regulators as well.

What must be included in the Ombudsman notification?

The notification must include the nature of the breach, the categories of personal data affected, the approximate number of individuals involved, the likely consequences for those individuals, the measures taken or proposed to address the breach, and the contact details of the person the Ombudsman should liaise with. Supporting evidence such as logs or forensic reports should be attached.

Is there a 72‑hour rule for data breach reporting in the Cayman Islands?

No. The Cayman Islands uses a five‑day standard, not the 72‑hour window found in the EU and UK GDPR frameworks. However, because the Cayman clock starts from when you should have known (rather than when you actually became aware), the practical deadline can be shorter than it first appears. See the comparison table above for a side‑by‑side breakdown.

What are the penalties for failing to notify a data breach?

Failure to notify the Ombudsman or affected individuals within the required timeframe is a criminal offence under the DPA. On conviction, the maximum fine is CI $100,000. Officers and directors who consented to or connived in the failure may also face personal liability.

How do I complete the Ombudsman data breach notification form?

Download the fillable PDF from the Ombudsman’s data protection guidance page, complete each section using the field‑by‑field guidance provided in this article, attach supporting evidence, and email the completed form to the Ombudsman’s office. If electronic submission is not possible, print and hand‑deliver the form to the Ombudsman in George Town.

Do I need to notify overseas regulators as well?

Possibly. If the breach involves personal data of individuals in jurisdictions with their own notification requirements, such as the EU (GDPR, 72‑hour rule) or the UK (UK GDPR), you must comply with each applicable regime independently. Multinational controllers should follow the strictest applicable deadline and co‑ordinate notifications across all relevant authorities.

How To Report A Data Breach | Global Law Experts

Last updated: 23 May 2026

If your organisation in the Cayman Islands discovers a personal data breach, the Data Protection Act (2021 Revision) requires you to notify both the Ombudsman and affected individuals within a strict five‑day window, making it essential to understand exactly how to report a data breach before an incident occurs. The Ombudsman’s own guidance states that the notification must be made “without undue delay, but not later than 5 days after you should, with the exercise of due diligence, have been aware of the breach.

” Unlike the more widely publicised 72‑hour deadline under the EU and UK GDPR frameworks, Cayman’s clock is measured in calendar days from the point a reasonable controller should have known, not from when it actually found out. This article walks through every step, from assessing whether a reportable breach has occurred, to completing the Ombudsman’s official Personal Data Breach Notification Form online, to notifying the people whose data was compromised, and sets out the penalties for getting it wrong.

Quick Answer, Do You Need to Report Now?

Yes, if personal data has been compromised. Under section 16(1) of the Cayman Islands Data Protection Act, every data controller that experiences a personal data breach must report it to the Office of the Ombudsman and to every affected individual. The process, in brief, is: (1) contain the breach and preserve evidence; (2) assess whether personal data is involved; (3) complete and submit the Ombudsman’s notification form; (4) notify each affected individual; and (5) remediate and document lessons learned.

The critical deadline: you have no more than 5 calendar days from the date you should reasonably have become aware of the breach. Failure to notify is a criminal offence that can result in a fine of up to CI $100,000.

Who Must Report a Personal Data Breach in the Cayman Islands?

The primary obligation falls on the data controller, that is, the organisation that determines the purposes and means of processing personal data. A data processor (for example, a cloud hosting provider or outsourced payroll company) that becomes aware of a breach must inform the data controller promptly so the controller can meet its five‑day deadline, but the processor does not file the Ombudsman notification itself. This distinction is critical: if you are processing personal data on behalf of another organisation, your contractual arrangements should specify exactly how and when you will alert the controller.

In practice, the data breach notification requirements in the Cayman Islands mean that a wide range of entities carry controller‑level responsibility. Any company, partnership, sole trader, charity, or government body that collects or uses personal data about identifiable individuals, whether employees, clients, or members of the public, qualifies as a data controller under the Act.

Entity type	Likely role	Notification responsibility
Employer collecting staff HR data	Data controller	Must notify Ombudsman + affected individuals directly
IT service provider hosting client databases	Data processor	Must inform the data controller without undue delay; controller files notification
Fund administrator handling investor KYC records	Data controller (or joint controller)	Must notify Ombudsman + affected individuals directly

If you are unsure whether your organisation is a data controller or data processor, the Ombudsman recommends reviewing the Cayman Islands regulatory practice area guidance and seeking specialist legal advice before a breach occurs.

When to Notify, The DPA 5‑Day Rule Explained (With Examples)

The statutory wording that governs how to report a data breach in the Cayman Islands is precise. According to the Ombudsman’s published guidance, “You must report a personal data breach to the Ombudsman and the individual(s) concerned without undue delay, but not later than 5 days after you should, with the exercise of due diligence, have been aware of the breach.” This language, drawn from section 16(1) of the Data Protection Act, creates a notification clock that starts running not when you actually discover the breach, but when a reasonable organisation exercising due diligence would have discovered it.

What “With the Exercise of Due Diligence” Means

The due‑diligence standard means the Ombudsman will assess when your organisation should have become aware, not merely when it did. An organisation that lacks basic monitoring, no intrusion‑detection systems, no regular log reviews, no staff training on recognising phishing, cannot claim ignorance simply because it took weeks to notice a compromise. Industry observers expect the Ombudsman to take a dim view of controllers who delay discovery through inadequate systems. In practical terms, this means you should already have logging, monitoring, and incident‑response procedures in place.

If an audit trail shows that anomalous access occurred on Day 1, but your IT team only noticed on Day 10 because nobody checks logs, the five‑day clock likely started on Day 1, or at least within a short period thereafter.

What Counts as “Aware”

Awareness arises at the point when the organisation has a reasonable degree of certainty that a security incident has compromised personal data. You do not need to have completed a full forensic investigation before the clock starts. As Harneys note in their Cayman Islands data breaches summary, “This notification must be made without undue delay, but no longer than five days after the data controller should have reasonably known about the breach.” A few practical examples illustrate the distinction:

Ransomware attack locks all servers on Monday morning. Awareness is immediate. The five‑day window runs from Monday, meaning you must notify by Saturday.
Anomalous login from an unknown IP detected on 1 June; investigation confirms data exfiltration on 4 June. A reasonable controller reviewing logs promptly would likely have flagged the anomaly by 2 June, so the five‑day clock probably started no later than 2 June. Notification is due by 7 June at the latest.
Third‑party processor informs you of a breach on 15 July, but the incident occurred on 1 July. The Ombudsman may ask why the processor took two weeks to notify you and whether your contract required faster escalation. The practical effect is that the clock may start well before 15 July.

The key takeaway: do not wait for the investigation to conclude before starting the notification process. File the Ombudsman form with the information available and update it as your investigation progresses.

How to Report a Data Breach Online, Step‑by‑Step Ombudsman Filing Walkthrough

Understanding how to report a data breach in the Cayman Islands online begins with the Ombudsman’s official Personal Data Breach Notification Form. The form is published as a fillable PDF on the Ombudsman’s website and can be submitted electronically. The following numbered steps walk through the entire process from download to confirmation.

Download the form. Access the Personal Data Breach Notification Form from the Ombudsman’s website. The current version is available at the Ombudsman’s data protection guidance page.
Identify the data controller. Enter the full legal name, registered address, and contact details of the data controller. If a Data Protection Officer (DPO) has been appointed, include the DPO’s name and direct contact details.
Describe the breach. Provide a clear, factual narrative of what happened, when it was discovered, and the type of security incident (e.g., unauthorised access, accidental disclosure, ransomware, lost device).
Specify the categories of personal data affected. Tick or list the types of data involved, names, identification numbers, financial data, health records, biometric data, etc.
Estimate the number of individuals affected. Provide an approximate count. If the exact number is not yet known, state “under investigation” and give a best estimate with a commitment to update.
Describe the likely consequences. Explain the potential impact on affected individuals, identity theft risk, financial loss, reputational harm, discrimination, or other adverse effects.
Detail the measures taken. List the containment steps already completed (e.g., passwords reset, access revoked, systems isolated) and the remediation measures planned.
Attach supporting evidence. Include any relevant logs, screenshots, forensic reports, or communications. The Ombudsman’s form notes that data controllers are required under section 16(1) of the Act to submit the notification with supporting documentation.
Submit the form. Email the completed PDF and attachments to the Ombudsman’s office. Retain proof of submission (delivery receipt and timestamp).
Follow up. The Ombudsman may request additional information. Respond promptly, delays in co‑operating with the regulator can be treated as a separate compliance failure.

Filling the Data Breach Notification Form, Field‑by‑Field Guidance

The Ombudsman’s Personal Data Breach Notification Form is structured into clearly defined sections. The table below maps each required field to what you should enter and provides a worked example to assist first‑time filers.

Form field	What to put	Example
Data controller name & registration number	Full legal entity name and any DPA registration reference	ABC Fund Services Ltd, Reg. No. 12345
DPO / contact person	Name, title, direct email, phone	Jane Smith, Compliance Officer, jane@abcfund.ky, +1 345 XXX XXXX
Date and time of breach	When the incident occurred (or best estimate)	12 May 2026, approximately 02:30 UTC
Date controller became aware	When your organisation first identified the breach	13 May 2026, 09:15 local time
Nature of the breach	Type of incident, unauthorised access, loss, disclosure, etc.	Unauthorised access to client database via compromised employee credentials
Categories of data	Types of personal data involved	Names, passport numbers, bank account details
Approximate number of individuals	Best estimate (update later if needed)	Approximately 340 individuals (investigation ongoing)
Likely consequences	Impact on data subjects	Risk of identity fraud and financial loss
Measures taken / proposed	Containment and remediation steps	Credentials reset, forensic investigation engaged, affected individuals being notified

How to Submit if the Online System Is Unavailable

If for any reason you are unable to submit the form electronically, for example, during a system outage or where the breach itself has compromised your email infrastructure, you can submit the completed PDF by alternative means. Download and print the form, complete it by hand, and deliver it to the Office of the Ombudsman in George Town. Retain a copy with a dated cover letter. Early indications suggest the Ombudsman will accept initial notification by telephone in genuinely urgent situations, provided the written form follows promptly. Whatever submission method you use, ensure you can prove the date and time of delivery.

What to Include in Your Notification, Minimum Information & Evidence

Understanding the data breach notification requirements in the Cayman Islands means knowing exactly what information the Ombudsman expects to see. The minimum content for a compliant notification includes:

Nature of the breach. A factual description of the incident, including how it was discovered and the attack vector or cause.
Categories of personal data. Which types of data were affected (e.g., identification documents, financial records, health information).
Approximate number of individuals. A best estimate, with a commitment to update if the figure changes as the investigation continues.
Likely consequences. An honest assessment of the potential harm to affected individuals.
Measures taken or proposed. Both the immediate containment steps and the longer‑term remediation plan.
Contact details. The name, title, email, and phone number of the person the Ombudsman should contact for further information.
Supporting evidence. Attach relevant logs, forensic reports, or screenshots where available.

Below is a sample three‑paragraph template that can be adapted for the narrative section of the Ombudsman notification:

“On [date], [Organisation Name] identified a personal data breach involving [brief description of incident]. The breach affected approximately [number] individuals whose [categories of data] may have been compromised. We became aware of the incident on [date of awareness] when [describe how it was discovered].

The likely consequence for affected individuals is [e.g., risk of identity fraud, potential financial loss]. We have taken the following immediate steps to contain the breach: [list containment measures].

We are continuing our investigation and will provide the Ombudsman with updated information as it becomes available. Our designated contact for this matter is [name, title, email, phone].”

Notifying Affected Individuals, When and How

In addition to telling the Ombudsman, you must also tell the people whose data was breached. Under the Act, notification to affected individuals must be made “without undue delay, but not later than 5 days” using the same due‑diligence clock that applies to the Ombudsman notification. As Conyers note in their practitioner guide, “A personal data breach must be reported to the Ombudsman and to the individual(s) concerned without undue delay but not later than 5 days after you should have reasonably known about the breach.”

The notification to individuals should be written in clear, plain language and must include:

What happened. A concise description of the breach.
What data was affected. The categories of personal data compromised.
What you are doing about it. The steps taken to contain and remediate the breach.
What they should do. Practical advice, change passwords, monitor bank statements, be alert to phishing.
How to contact you. A direct phone number or email for questions.

Below is a sample four‑sentence template for individual notices:

“We are writing to inform you that [Organisation Name] experienced a data security incident on [date] that may have affected your personal information, specifically [categories of data]. We have taken immediate steps to secure our systems, including [brief measures]. We recommend that you [specific protective action, e.g., change your password and monitor your accounts for unusual activity]. If you have questions or concerns, please contact [name] at [email/phone].”

Notifications can be sent by email, letter, or other direct communication methods appropriate to the relationship. Where it is not possible to contact individuals directly, for example, because contact information was itself lost in the breach, a public notice may be necessary. How to notify data subjects in Cayman is a topic that warrants careful legal planning, ideally before a breach occurs.

Penalties, Enforcement and Practical Risks Under the Cayman DPA

The consequences of failing to report a data breach are not merely theoretical. The Data Protection Act creates criminal offences for non‑compliance, and the Ombudsman has enforcement powers to investigate and prosecute. As Collas Crill note, “Failure to notify the data breach when required to do so is an offence under the DPA and can result in a conviction and fine of $100,000.”

Offence	Maximum penalty	Additional consequences
Failure to notify the Ombudsman of a personal data breach within the 5‑day window	CI $100,000 fine on conviction	Criminal record; potential personal liability for officers and directors
Failure to notify affected individuals	CI $100,000 fine on conviction	Reputational damage; civil claims from affected individuals
Obstruction of an Ombudsman investigation	CI $100,000 fine on conviction	Adverse inference; escalated regulatory scrutiny
Processing personal data without adequate security measures (contributing to the breach)	Enforcement notice; potential fine	Mandatory remediation orders; public censure

The likely practical effect of these provisions is twofold. First, the significant financial penalties create a strong incentive to invest in breach‑readiness before an incident occurs. Second, because the offences are criminal rather than purely administrative, individual officers and directors who were involved in or consented to the failure may face personal liability, not just the company. Industry observers expect the Ombudsman to take an increasingly active enforcement posture as awareness of the DPA grows across the Islands’ financial services and technology sectors.

Practical Checklist and Timeline

Use the following step‑by‑step checklist to manage your response when a breach is discovered. This timeline assumes the five‑day clock has already started:

Immediately (Hour 0–4): Contain the breach, isolate affected systems, revoke compromised credentials, and preserve all forensic evidence.
Day 1: Convene your incident‑response team. Conduct an initial assessment to determine the scope, categories of data, and approximate number of individuals affected.
Day 1–2: Begin completing the Ombudsman Personal Data Breach Notification Form. Gather all available evidence and supporting documentation.
Day 2–3: Draft individual notification letters or emails. Have legal counsel review all communications before sending.
Day 3–4: Submit the completed form to the Ombudsman. Send notifications to all affected individuals.
Day 5 (deadline): Confirm that both the Ombudsman and all identifiable affected individuals have been notified. File internal records documenting every step taken and the timeline.
Post‑incident (Days 6–30): Continue the forensic investigation. Submit any updated information to the Ombudsman. Conduct a post‑incident review and update your data protection compliance procedures, security measures, and staff training.

This checklist is designed to be printed and kept on file as part of your organisation’s incident‑response plan. Data protection compliance in Cayman Islands requires proactive planning, waiting until a breach occurs to develop these procedures is not a defensible position.

Comparison Table, Cayman 5 Days vs GDPR 72 Hours vs Common Practice

For multinational controllers processing personal data in the Cayman Islands and other jurisdictions, the question of what is the 72‑hour rule for data breach and how it interacts with Cayman’s requirements is critical. The table below summarises the key differences.

Jurisdiction	Notification clock	Who to notify
Cayman Islands (Data Protection Act)	Without undue delay but not later than 5 days after controller should, with due diligence, have been aware	Ombudsman (supervisory authority) + affected individuals where required
EU GDPR / UK GDPR	Without undue delay and, where feasible, not later than 72 hours after becoming aware (high‑risk breaches)	Supervisory authority + data subjects if high risk to rights and freedoms
Common practice (multinational)	Varies (72 hours to 30 days); follow the strictest applicable law and cross‑border notification protocols	Local supervisory authority(s) + affected individuals per local rules

Note that the GDPR’s 72‑hour window starts from when the controller becomes aware, whereas Cayman’s five‑day window starts from when the controller should have become aware with due diligence, a potentially earlier trigger. If your organisation is subject to both regimes, the practical approach is to aim for the shortest applicable deadline. Cross-border data breach notifications require careful legal co‑ordination across all affected jurisdictions.

Need Legal Advice?

This article was produced by Global Law Experts. For specialist advice on this topic, contact Tim Dawson at Campbells Legal, a member of the Global Law Experts network.

Where to Get Help, Lawyers & Resources

Reporting a personal data breach correctly under the Cayman Islands Data Protection Act requires speed, accuracy, and a clear understanding of the legal thresholds. If your organisation has experienced or suspects a breach, obtaining specialist legal advice early can help you meet the five‑day deadline and avoid criminal liability. Browse the Cayman Islands lawyer directory to find qualified data protection and regulatory law practitioners who can guide you through every step of how to report a data breach and manage the aftermath effectively.