Cayman Islands Government
External Privacy Notice
Version: 1.0
Initial release date: 13 November 2025
Date of current version: 13 November 2025
Document Administration
| Document location: | https://www.doe.ky |
| Document name: | Department of Environment – External Privacy Notice |
Revision Record
| Version | Date | Revision Description | Author |
| 1.0 | 13 November 2025 | Initial document release | Shelly-Ann Davis (Data Protection Leader- Department of Environment) |
Version Control Notice:
This document is a controlled document that supersedes all previous versions. Please discard any previous copies of this document dated prior to the version and publication date noted above this page.
Anyone who obtains an electronic or printed version of this document is responsible for ensuring that they have the latest version. The latest version of this document is available on https://www.doe.ky and can also be obtained by email on request to doe@gov.ky.
Privacy Notice
1. Scope
The Cayman Islands Government Department of Environment (DoE), respects your privacy and takes care in protecting your personal data. As a “Data Controller”, we comply with the Cayman Islands Data Protection Act (2021 Revision) (the “DPA”). This privacy notice (“Privacy Notice”) demonstrates our commitment to ensuring your personal data will be handled responsibly and applies to the Department of Environment.
This Privacy Notice Does not apply to the DoE when we are processing personal data relating to our employees, who are covered under our Employee Privacy Notice.
2. What Personal Data We Collect
The DoE may collect your personal data, directly from you or indirectly from third party sources, including via the ‘Cayman DoE’ mobile app. Personal data collected by the DoE will be limited to what is necessary for our processing activities. In this Privacy Notice, “personal data” means any data relating to an identified or identifiable living individual. The term “personal data” also includes a category of personal data known as “sensitive personal data”, which is defined in the DPA and includes data relating to your physical or mental health or condition, medical data and criminal offence data.
The DoE may collect the following information directly from you or other sources:
- Name, date of birth, photograph(s), address(es) and contact details;
- Personal data contained within government-issued identification document(s);
- Citizenship/nationality and immigration status in the Cayman Islands;
- Location data;
- Information about educational and employment status and history;
- Financial information;
- Medical data and information about physical or mental health or conditions;
- Criminal convictions and information about the commission, or alleged commission, of criminal offences and any proceedings related to offences;
- Opinions about you;
- Personal data you provide through our website, https://www.doe.ky such as:
- personal data provided within comments and questions, including your name and/or email address if you provide these details in our web form. If you ask questions about our public services and programmes or provide information about your relationship with us, this may also reveal other personal data, e.g. your location, employment status, immigration status in the Cayman Islands, health, family relationships or property ownership;
- your email address and subscription preferences if you sign up for our newsletters or notifications, and how you utilise our emails, including whether you open them and which links you click;
- Personal data you provide when you visit the DoE’s offices and other locations, or when you contact us by email, by telephone or through our social media channels;
- Personal data you provide when interacting with the DoE on our social media platforms, including Facebook, Instagram, LinkedIn, YouTube and WhatsApp, as well as personal data you provide when completing public consultation surveys.
- Personal data you provide or that we obtain from third party sources when you access our programmes and services, including our online services and ‘Cayman DoE’ app;
- Personal data collected via CCTV at our premises and other locations where we operate, including images via cameras located at 580 North Sound Road, George Town, Grand Cayman;
- Personal data collected via our Conservation Officer’s dash cams and body cams;
- Personal data that may be inadvertently collected via cameras and other monitoring equipment that is in place to monitor animals or the environment;
- Personal data that you provide when you enquire about or apply for a job or internship with the DoE. If you apply for a job via the CIG e-recruitment platform, an additional privacy notice is available at: https://careers.gov.ky/application/custom/English/privacy-statement.html; and
- Any other personal data where the collection is necessary to achieve our lawful purpose(s).
3. How We Use Your Personal Data
The purpose of the Civil Service is to make the lives of those we serve better. We are dedicated to supporting the elected government by delivering caring, modern and customer-centred public services and programmes, which deliver value for money.
The Mission of the Department of Environment is to facilitate responsible management and sustainable use of the natural environment and the natural resources of the Cayman Islands; through environmental protection and conservation, wise use, scientific research and public education.
The DoE may use your personal data for the following purposes:
a. Implementing policies, providing services and programmes, and managing your relationship with us;
b. Responding to your inquiries;
c. Verifying your identity;
d. Providing the optional location service feature in the Cayman DoE app to allow users to see where they are on a map in relation to the marine zones if they have opted in to accessing this feature via the app on their device (we do not store or share the data provided via Google Maps which allows this optional functionality);
e. Measuring how users interact with DoE’s website and continually improving our communications channels (including by aggregating personal data collected using cookies);
f. Communicating and interacting with website visitors;
g. Communications and public relations activities;
h. Managing accounts payable and receivable, preventing fraud, and protecting public funds;
i. Statistical and other reporting, both internally and externally;
j. Seeking legal advice, and exercising or defending legal rights;
k. Complying with our legal obligations, including all legislation that applies across the public sector, e.g. legislation that provides for records and information management, procurement, human resource management, financial management, audit, and similar functions and activities;
l. Communicating and interacting with job applicants and related third parties (e.g., references) and carrying out recruitment and selection processes;
m. Ensuring other agencies are able to carry out their public functions if it is necessary for us to disclose your personal data directly to them, including to verify information you have provided;
n. Reporting a suspected crime or other breach of the law, or assisting a law enforcement agency or other competent authority in the course of an investigation, whether in the Cayman Islands or in another jurisdiction;
o. Disclosing records held by the DoE if we are required to do so under the Freedom of Information Act (2021 Revision). If we receive a Freedom of Information (“FOI”) request for records that include your personal data, we will always consult with you in writing if we are considering disclosing any of your personal data and you will also have the right to appeal our final decision to the Ombudsman if you have not provided your consent for the disclosure;
4. How We Share Your Personal Data
The DoE may share your personal data as required, including under applicable legislation, with recipients that include our Data Processors and third parties. We will only share your personal data as permitted by the DPA and in accordance with other applicable laws and policies.
Your personal data may be shared with the following types of recipients:
a. Other public authorities: Personal data may be shared with other CIG ministries, portfolios, offices, departments, statutory authorities, statutory bodies and government companies as required or permitted by law and for one or more of the purposes set out in this Privacy Notice. These other public authorities include but are not limited to the Office of the Auditor General and Internal Audit Service in the course of an audit; Office of the Ombudsman in the course of an investigation; Royal Cayman Islands Police Service and other law enforcement agencies if a suspected crime is reported; Portfolio of Legal Affairs to obtain legal advice or representation; Treasury Department to manage payments to suppliers; Cabinet or the National Security Council in formal submissions to these statutory bodies; the Computer Services Department and Department of E-Government for information technology services
b. Data Processors external to the CIG: Personal data may be shared with our service providers. When acting as Data Processors, service providers are only able to use personal data under our instructions. We engage Data Processors for a variety of activities, which may include:
i. Webhosting;
ii. Information Technology;
iii. Records and Information Management, including storage facilities;
iv. Communications, marketing and campaigns, and events management; and
v. Security operations and fraud prevention.
In limited circumstances, service providers who act as data processors for the DoE may also act as a separate data controller in relation to their own purposes for processing your personal data, e.g. to provide customer support, or for analytics or machine learning in order to improve their services. These are unrelated to the purposes for which the DoE processes your personal data and should be clearly and directly disclosed to you by the service provider through their own separate privacy notice. However, you may contact us to ask about our current service providers and specific instances, if any, that we are aware of where your personal data may be processed for a service provider’s own purposes.
c. Legal advisors and other persons if required by law or in relation to legal proceedings or rights: Personal data may be disclosed as legally required, for the purpose of or in connection with proceedings under the law, if necessary to obtain legal advice, or if the disclosure is otherwise necessary to establish, exercise or defend legal rights. This may include disclosing your personal data for the following purposes:
i. Seeking legal advice;
ii. Exercising or defending legal rights;
iii. Complying with audits or investigations by competent authorities; and
iv. Complying with information security policies or requirements.
d. Other third parties: Personal data may be disclosed to other third-party recipients for the purposes set out in this Privacy Notice and in accordance with the DPA.
5. Our Legal Bases for Processing Your Personal Data
Depending on applicable laws and other circumstances, The DoE will rely on specific legal bases, or “conditions of processing”, under the DPA to process your personal data. These may include:
a. A legal obligation to which the DoE is subject, including under the Endangered Species (Trade and Transport) Act (2017 Revision), Endangered Species (Trade and Transport) Regulations (2015), Endangered Species Protection and Propagation Act (1999 Revision), Species Bred in Captivity or Artificially Propagated Regulations (1998 Revision), Marine Conservation (Fishing Licences) Regulations 2003, National Conservation Act 2013, Data Protection Act (2021 Revision) and Data Protection Regulations 2018; or to comply with various obligations under the National Archive and Public Records Act (2015 Revision) and National Archive and Public Records Regulations 2007,The Procurement Act (2023 Revision) and Procurement Regulations (2022 Revision), The Public Management and Finance Act (2020 Revision) and Financial Regulations (2024 Revision), The Public Service Management Act (2018 Revision) and Personnel Regulations (2025 Revision), Public Authority Act (2020), Standards in Public Life Act (2021);
b. To exercise public functions, the Department of Environment conducts research and management of native species and habitats in the Cayman Islands; will offer presentations at local schools and public events as well as publish articles and online content to present updates on this work and foster a sense of connection to these vital resources. This includes cultivating a lasting legacy of sustainability in the Cayman Islands by achieving environmental, social, and economic balance, with a view to maximising benefits across all three areas to make the lives of current and future generations better; to facilitate Coastal Works licences, Wildlife Interaction Zone (WIZ) Licenses, and Convention on International Trade in Endangered Species of Wild Fauna and Flora (CITES) Permits; etc.
c. To protect your vital interests;
d. Your consent, e.g. to administer surveys and polls; and
e. For the purposes of legitimate interests pursued by the DoE or by a third party or parties to whom the personal data may be disclosed, e.g. when responding to FOI requests or to enquiries from law enforcement agencies and other competent authorities.
Where we process your sensitive personal data, we will also meet a second legal basis. These legal bases may include:
a. To exercise our public functions;
b. To protect your vital interests or those of another individual;
c. In relation to legal proceedings, including obtaining legal advice and otherwise establishing, exercising or defending legal rights;
d. If you have taken steps to make the personal data public; and
e. Your consent.
6. Children’s Personal Data
The DoE collects personal data relating to children under the age of 18 to enable us to deliver public education and programmes and carry out our functions. We may collect children’s personal data for any of the purposes set out in section 3 of this Privacy Notice.
7. Security and International Transfers
The DoE has implemented appropriate technical, physical and organisational measures in order to keep your personal data secure. These safeguards to maintain the confidentiality, integrity and availability of your personal data may include role-based controls, separation of duties, user access management, strong passwords policy, audit logs and other technical controls e.g. penetration tests to ensure the robustness of our systems.
The DoE will not transfer personal data to countries or territories that do not ensure an adequate level of protection for personal data. We will only transfer your personal data to a country or territory that ensures an adequate level of protection for your rights and freedoms in relation to the processing of your personal data, unless there is a relevant exemption or exception under the DPA. Exceptions may include your consent or appropriate safeguards.
8. How Long We Keep Your Personal Data
The DoE may store your personal data for as long as we need it in order to fulfil the purpose(s) for which we collected your personal data, and in line with any applicable laws. This includes the National Archive and Public Records Act (2015 Revision), which governs the creation, maintenance and disposal of all public records. Sometimes, we may anonymise your personal data so that it is no longer associated with you.
9. Your Rights
The DoE will respect and honour your rights in relation to your personal data and implement measures that allow you to exercise your rights under the DPA and other applicable legislation.
In accordance with the DPA, your rights in relation to your own personal data include:
a. The right to be informed and the right of access: The right to request access to all personal data the DoE maintains about you as well as supplementary information about why and how we are processing your personal data. This is commonly known as a Data Subject Access Request (“DSAR”) and certain supplementary information about our processing is contained within this Privacy Notice.
b. Rights in relation to inaccurate data: The right to request the rectification, blocking, erasure or destruction of any inaccurate personal data the DoE maintains on you. We will ensure, through all reasonable measures, that your personal data is accurate, complete and, where necessary, up‑to‑date, especially if it is to be used in a decision-making process.
c. The right to stop or restrict processing: The right to restrict or stop how the DoE uses your personal data in certain circumstances.
d. The right to stop direct marketing: The right to stop the DoE from using your personal data for direct marketing purposes. The DoE does not currently carry out any direct marketing activities.
However, we will update this Privacy Notice and we will also notify you in writing as required if this position changes.
e. Rights in relation to automated decision making: The right to obtain information about and object to the use of automated decision making by the DoE using your personal data. The DoE does not currently use automated means to make decisions about you. However, if this position changes, we will update this Privacy Notice and we will also notify you in writing as required.
f. The right to complain: The right to complain to the Ombudsman about any perceived violation of the DPA by the DoE.
g. The right to seek compensation: The right to seek compensation through the Courts if you suffer damage due to a contravention of the DPA by the DoE.
You may contact the DoE, using the contact details listed below, to make a DSAR to access and review your personal data or to exercise any other rights provided to you under the DPA. The DoE will take into consideration circumstances where, under the DPA or other applicable legislation, your rights may be limited or subject to conditions, exemptions or exceptions.
Upon contacting the DoE, we may need to verify your identity prior to fulfilling a DSAR and may request additional information as required. In accordance with the DPA, the DoE may also charge a reasonable fee in relation to your DSAR if it is unfounded or excessive in nature, or the DoE may reserve the right not to comply with the request at all.
To learn more about your rights, visit www.ombudsman.ky.
10. Data Protection Principles
When processing your personal data, the DoE will comply with the eight Data Protection Principles defined within the DPA:
a. Fair and lawful processing: Personal data shall be processed fairly. In addition, personal data may be processed only if certain conditions are met, for example the DoE is subject to a legal obligation that requires the processing or the processing is necessary for exercise of public functions.
b. Purpose limitation: Personal data shall be obtained only for one or more specified, explicit and legitimate purposes, and not processed further in any manner incompatible with that purpose or those purposes.
c. Data minimisation: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are collected or processed.
d. Data accuracy: Personal data shall be accurate and, where necessary, kept up-to-date.
e. Storage limitation: Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose.
f. Respect for the individual’s rights: Personal data shall be processed in accordance with the rights of data subjects under the DPA, including subject access.
g. Security – confidentiality, integrity and availability: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
h. International transfers: Personal data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
11. How to Contact Us
The DoE has appointed a Data Protection Leader, who has operational responsibilities for data protection. If you have any questions about this Privacy Notice or how your personal data are handled, or if you wish to make a complaint, please contact:
Shelly-Ann Davis, Data Protection Leader
Telephone number: (345) 244-5914
Email Address: doe@gov.ky
Address: 580 North South Road, George Town, Grand Cayman.
The DoE aims to resolve inquiries and complaints in a respectful and timely manner.
If you would like to submit a Data Subject Access Request (DSAR), the Information Manager for the DoE, who has been appointed under the Freedom of Information Act (2021 Revision) (the “FOI Act”), handles these requests. Requests relating to your own personal data may be made in writing to Shelly-Ann Davis DoE@gov.ky. Depending on the scope of your request, to ensure you receive all records and information you are entitled to by law, your request may be processed under the DPA, under the FOI Act, or under both enactments.
13. Changes to this Privacy Notice
The DoE reserves the right to update this Privacy Notice at any time and will publish a new Privacy Notice when we make any substantial updates.
From time to time, the DoE may also notify you about the processing of your personal data in other ways, including by email or through our publications.
This Privacy Notice was last updated on 05 November 2025
Download the Privacy Notice