Personal Data and Lawful Conditions
Law
Under the Data Protection Act (2021 Revision), entering personal data into an automated tool remains processing, and a supplier arrangement does not remove the controller's duties. The Act sets distinct conditions for ordinary and sensitive personal data, security safeguards and individual rights. Health information is sensitive personal data. Our recommendation: identify the lawful condition and data sensitivity before staff place personal records into any prompt or workflow.
Put it into practice. Map each automated workflow to a documented lawful processing condition and block sensitive personal data where no condition applies.
Data Protection Act (2021 Revision) (2021-03-31; checked 4 November 2026); Cayman Islands legislation index by subject (2026-11-04; checked 4 November 2026)
Processors and Supplier Contracts
Regulator guidance
Ombudsman guidance states that controller-to-processor arrangements require written contract terms covering controller instructions and security. It also discusses additional provisions for subprocessors, breach reporting and audit or return of data according to the processing and risk. A supplier may act as a controller for some activities, such as model training, rather than a processor throughout. Our recommendation: verify whether a vendor reuses inputs for its own purposes before treating it as a processor.
Put it into practice. Review vendor terms to confirm the supplier's role, disable provider training on business inputs, and document subprocessor and return obligations.
Contracts between data controllers and data processors (Undated; checked 4 November 2026); Data Protection Act (2021 Revision) (2021-03-31; checked 4 November 2026)
Overseas Transfers and Hosted Paths
Mixed
Under the eighth data protection principle, controllers must verify destination adequacy or a Schedule 4 condition and review recipient roles. For in-scope entities, CIMA's April 2023 cybersecurity guidance treats cloud computing as outsourcing and addresses overseas-jurisdiction risk, data isolation, recovery and exit plans. Our recommendation: trace where prompts, uploads, logs, backups and support access reside before enabling a hosted assistant.
Put it into practice. Document the geographic path of prompts, logs and backups, and verify transfer safeguards and exit plans before live deployment.
Eighth data protection principle: international transfers (Undated; checked 4 November 2026); Statement of Guidance: Cybersecurity for Regulated Entities (2023-04; checked 4 November 2026)
Separate Breach and Incident Clocks
Mixed
Cayman entities can face two distinct reporting clocks. Under the Data Protection Act, controllers must report a personal data breach to the Ombudsman and affected individuals without undue delay and within five days of when they should, with due diligence, have been aware. Missing details do not justify waiting. Under CIMA's April 2023 Cybersecurity Rule 8.1, in-scope entities must immediately notify CIMA in writing of a material or potentially material incident, and no later than 72 hours after discovery. Our recommendation: track both requirements independently in your incident playbook.
Put it into practice. Maintain separate escalation triggers for immediate written CIMA notification, with its 72-hour outer limit after discovery, and the five-day Ombudsman due-diligence awareness deadline.
Personal data breaches (Undated; checked 4 November 2026); Rule: Cybersecurity for Regulated Entities (2023-04; checked 4 November 2026)
Banking, Funds and Outsourcing Scope
Mixed
CIMA's April 2023 Cybersecurity Rule requires documented cybersecurity controls and oversight for in-scope entities. Its Outsourcing Statement of Guidance sets expectations for oversight and materiality assessments. Both instruments exclude regulated mutual funds and private funds, and the Outsourcing guidance also excludes private trust companies. Those exclusions do not remove funds' separate governance, data protection or applicable AML responsibilities. Fully managed Class B, C and D insurers have special scope under Cybersecurity Rule 3.4. Our recommendation: assess an automated tool against the entity's actual licence and service materiality rather than assuming every tool is material outsourcing.
Put it into practice. Check entity licence scope and exemptions first, then assess service materiality and administrator or manager coverage in writing.
Rule: Cybersecurity for Regulated Entities (2023-04; checked 4 November 2026); Statement of Guidance: Outsourcing, Regulated Entities (2023-04; checked 4 November 2026); Statement of Guidance: Cybersecurity for Regulated Entities (2023-04; checked 4 November 2026); Banking Services Regulatory Measures (Undated; checked 4 November 2026); Statement of Guidance: Corporate Governance—Mutual Funds and Private Funds (2023-04; checked 4 November 2026)
AML Programmes and Financial Sanctions
Regulator rule
CIMA's Compliance Programme Rule and Financial Sanctions Rule took effect on 18 September 2026. They operate within the wider AML framework, including the Anti-Money Laundering Regulations (2025 Revision). Delegating tasks to third parties does not transfer ultimate compliance responsibility, and the AMLCO retains responsibility for the compliance programme despite delegating duties. Customer due diligence requires reliable independent sources, and sanctions screening requires documented rationale and re-screening after list updates. Our recommendation: never let a model summary or score replace primary records, official sanctions lists or documented officer review.
Put it into practice. Require human verification against primary documents and current official sanctions lists before clearing any onboarding or screening match.
Rule: Effective Compliance Programme for the Prevention and Detection of ML, TF, PF for Financial Services Providers (2026-09-18; checked 4 November 2026); Rule: Compliance with Financial Sanctions and Targeted Financial Sanctions (2026-09-18; checked 4 November 2026); CIMA AML/CFT frequently asked questions (2026-09-18; checked 4 November 2026); Cayman Islands legislation index by subject (2026-11-04; checked 4 November 2026)
Legal Practice Confidentiality and Supervision
Regulator guidance
The official Guidance Notes to the Cayman Islands Legal Services Code of Professional Conduct, published on 15 April 2026, address client confidentiality, privilege, employee training, technology and outsourcing risks, competence and supervision. Our recommendation: approve tools before staff disclose client material and require a qualified lawyer to verify every cited authority and filing.
Put it into practice. Require partner approval before placing client records into external tools and verify all generated authorities against primary law reports.
The Cayman Islands Legal Services Code of Professional Conduct, 2026 (2026-04-26; checked 4 November 2026); Guidance Notes to the Cayman Islands Legal Services Code of Professional Conduct, 2026 (2026-04-15; checked 4 November 2026)
Patient Safety and Clinical Responsibility
Law
The Health Practice Act (2026 Revision), published on 5 February 2026, sets the practitioner and facility framework, with the legislation index listing Amendment Act 14 of 2026 and Amendment Act 25 of 2026 (marked not in force). Health records are sensitive personal data under the Data Protection Act. Our recommendation: separate administrative drafting from clinical judgment, keep a registered clinician accountable for care decisions, and apply strict data protection controls to patient records.
Put it into practice. Restrict automated tools to approved administrative tasks unless a registered clinician reviews and takes responsibility for clinical outputs.
Health Practice Act (2026 Revision) (2026-02-05; checked 4 November 2026); Data Protection Act (2021 Revision) (2021-03-31; checked 4 November 2026); Cayman Islands legislation index by subject (2026-11-04; checked 4 November 2026)
Insurance Conduct and Benefit Decisions
Mixed
CIMA's insurance regulatory measures link conduct, governance, internal controls, cybersecurity, outsourcing and AML or sanctions duties, while Cybersecurity Rule 3.4 sets specific scope for fully managed Class B, C and D insurers. The Health Insurance Commission separately regulates health insurance and monitors approved insurers. Our recommendation: map obligations to the specific insurance licence, manager arrangement and personal-data footprint, and assign an accountable reviewer for any automated output affecting cover, underwriting, benefit decisions or policyholder notices.
Put it into practice. Designate a named reviewer for automated underwriting, cover or benefit outputs and verify how managed insurer rules apply.
CIMA Insurance Regulatory Measures (Undated; checked 4 November 2026); Rule: Cybersecurity for Regulated Entities (2023-04; checked 4 November 2026); Health Insurance Commission (Undated; checked 4 November 2026)
OfReg ICT and Sector Remit
Regulator guidance
OfReg's Information and Communications Technology remit covers telecommunications and broadcasting licensing, .ky domain administration, duties under the Electronic Transactions Act and work with government and stakeholders on national cybersecurity. It is not described as a general licensor for automated software tools. Our recommendation: raise ICT licensing, domain and applicable electronic-transactions questions with OfReg while directing data protection, financial, legal and health governance to the relevant sector regulator.
Put it into practice. Match each compliance question to the regulator with statutory authority over your sector and data processing activity.
OfReg Information and Communications Technology (Undated; checked 4 November 2026)