Guide to Data Protection Act for Data Controllers

What is exempted?

This exemption applies to personal data processed for the purposes of a corporate finance service provided by:

• a legally registered person providing for investment business;
• a person who is exempted from the obligation to be legally registered to provide an investment business;
• a person who is an authorised person providing for investment business;
• a person who is exempt in respect of investment business;
• a person who through their employment offers a corporate finance service; or
• a partner who provides a corporate finance service in a partnership.

“Corporate finance service” is defined as a service consisting of: 

What provisions in the DPA does the exemption relate to?

Under this exemption the personal data is exempt from:

• the first data protection principle to the extent that it requires compliance with paragraph 2(b) of Part 2 of Schedule 1 (notification of the purpose for the processing); and
• section 8 (the access right). 

When does the exemption apply?

The personal data is exempt to the extent that:

• the application of the provisions to the data could affect the price of any instrument; or
• the data controller believes the application of the provisions to the data could affect the price of an instrument.

The personal data may also be exempt if the exemption is necessary to safeguard an important economic or financial interest of the Cayman Islands. 

What else is there to consider?

For the purposes of this exemption an “instrument” represents investment, and may already be in existence, may be, or may yet to be created. 

Relevant provisions

Data Protection Act (2021 Revision)

Section 28: Exemption relating to corporate finance