A proposal to bring every company in the Whitter Group of Companies into compliance with the Data Protection Act, 2020, and to keep them there: a gap analysis, a complete readiness package, and an outsourced Data Protection Officer.
The Whitter Group holds personal data about tenants and their staff, prospective tenants, employees and applicants, contractors and vendors, visitors and shoppers through CCTV, access control and guest Wi-Fi, and the individuals behind its land and development conversations. Under the Act, each of the Group's nine companies is a data controller in its own right: bound by the eight data protection standards, required to register with the Office of the Information Commissioner where applicable, to appoint a Data Protection Officer, to assess the impact of its processing, and to report a personal data breach within seventy-two hours.
Much of it is the kind the Act treats most carefully.
Identification documents, financial statements, guarantor details, bank information, arrears histories.
Financial and identity data, retained for years, shared with lawyers, banks and the new tenant portal.Images of shoppers, staff and visitors at Whitter Village and Golden Triangle; entry logs; vehicle registrations.
Continuous collection from the public. Signage, retention and access rules are legal requirements.TRN, NIS, bank details, medical certificates, next of kin, performance and disciplinary records.
Sensitive personal data. Nine employers, nine sets of records.Sole traders' details, bank information, identification, insurance.
Third parties who also process the Group's data need written terms.Device identifiers, contact details, consent records.
Consent and opt-out must be demonstrable.All of the above, in one database, behind a public login.
Privacy by design from day one is far cheaper than retrofitting it.
The Act provides for fines, for compensation claims by individuals, and for personal liability of officers in certain circumstances. The more immediate exposure for a landlord is reputational: a tenant's financial file or a shopper's footage in the wrong hands is a story. Compliance is now a routine question from banks, insurers, auditors and development partners.
A structured assessment of each company against the Act, producing a Group report and a company-by-company view.
A complete, documented compliance framework for each of the nine companies, built on a Group template so every company carries the same standard and the Group can evidence it. Drafting begins in week 5, sequenced by the remediation plan, and the package is carried through to signed-off files by the outsourced Data Protection Officer from month two.
DPA Ready serves as the outsourced Data Protection Officer for the Group and each of its nine companies, with the access, independence and reporting line the Act contemplates. The DPO executes the readiness package and keeps it current.
The impact assessment for the ERP and the tenant portal is completed before either goes live, and the data inventory produced here becomes the authoritative list of personal data the platform holds.
| Item | Basis | Amount |
|---|---|---|
| Phases 1 and 2: gap analysis and readiness package | US$1,500 per billed company, three companies | US$4,500 one-time |
| Phase 3: outsourced Data Protection Officer | US$500 per billed company per month, three companies | US$1,500 per month |
| Six further companies | Onboarded, assessed, documented and supported under the same programme | No charge |
| Travel to Montego Bay | For sittings and training delivered in person | At cost, agreed in advance |
| Need | By when |
|---|---|
| A named coordinator in the Chief Executive's office | At signing |
| The list of nine companies with registered names, directors and principal activities, and the three to be billed | At signing |
| Access to the staff who handle tenant, employee, vendor, CCTV and finance records, for sittings of about forty-five minutes each | Weeks 2 to 3 |
| Existing contracts, notices, forms, vendor agreements and any IT or security documentation, uploaded to the secure portal | Week 2 |
| A walk of both properties with the security lead to map cameras, access points and signage | Week 2 or 3 |
On the Group's acceptance, DPA Ready issues its standard service agreement reflecting this proposal, with the schedule of nine companies and the three billed companies attached, opens the secure portal, and schedules the kick-off within one week of signature.
