Data Protection
Privacy by design, not as an afterthought.
Acuity Advisory Limited is building its operating system around the Jamaican Data Protection Act and practical controls suitable for financial, tax, payroll, KYC and advisory information.
Our operating principles
- Purpose limitation: collect and use information for clear, legitimate business and compliance purposes.
- Data minimisation: request only information reasonably relevant to the engagement or legal obligation.
- Accuracy: support correction and review of personal information.
- Retention discipline: retain data only while a valid business, legal, regulatory or professional purpose remains.
- Security: use role-based access, authentication, secure storage, audit events and controlled workflows.
- Accountability: record permissions, disclosures, privacy requests, processor reviews, incidents and governance decisions.
Consent and lawful processing
Acuity does not treat every processing activity as consent-based. Information that is necessary to perform an engagement or meet a legal obligation is handled under the appropriate lawful basis. Optional uses are separated and can be accepted or declined independently.
Data subject requests
Clients can use the Privacy Centre to request access, correction, restriction, withdrawal of optional consent, portability where applicable, objection or raise a privacy complaint/query. Each request receives a case record, status and audit trail.
Data sharing and processors
Acuity maintains a disclosure register and a processor/international-transfer register. External sharing should have a documented purpose, recipient, legal basis and approval where applicable.
Data incidents
Suspected breaches are recorded, contained and investigated using an incident workflow. The workflow records discovery time, affected information, risk, management actions and notification status so statutory reporting requirements can be managed promptly.
Professional review
The technology controls support Acuity's compliance programme but do not replace legal or Data Protection Officer review. Policies, retention periods, processor arrangements and client-facing legal wording should be reviewed periodically by appropriately qualified Jamaican professionals.