# How we protect respondent data The standard we work to when we interview people in Jamaica for a client, or for a study we run ourselves. This page is for clients who hire Balcostics Research to collect data, and for respondents who want the short version of how a field interview is handled. The website quote form is covered by the [privacy notice](/privacy/). This page is the fieldwork standard. The law is the Data Protection Act 2020 and the regulations made under it, including the Data Protection (Disposal of Personal Data) Regulations, 2024 (made 4 March 2024 and affirmed in the Jamaica Gazette of 17 September 2025). ## Processor or controller A **controller** decides why the data are processed and how. A **processor** handles the data for the controller, on written instructions. On an outsourced survey, you are usually the controller. You chose the population, the questionnaire and the purpose. Balcostics Limited is the processor. The contract is in writing. We program, field and clean only as that contract instructs. We tell you if an instruction would break the Act. The Act expects a processor to give the controller proper security, and to act only on instructions (section 30). On a study we design and run in our own name, including a myVoice survey we field as Balcostics, **Balcostics Limited** is the controller. If a contract names a different split, the contract is what we follow, and this page is the default where the contract is silent. Balcostics Limited is the company that trades as Balcostics Research. Address: Unit 10, QVilla Plaza, 7-9 Villa Road, Mandeville, Manchester, Jamaica. Email [research@balcostics.com](mailto:research@balcostics.com). Phones (876) 964-4046 and (876) 314-4543. ## What interviewers say before an interview Where you are the controller, interviewers read the consent wording you approved. We do not swap in a different script on the doorstep. Where we are the controller, the interviewer reads a short script before the first question. The script covers: - the name Balcostics Research, and the client name if there is one - the purpose of the survey, in ordinary words - that the person does not have to take part, and can skip a question or stop - that refusing will not cost them a service they are otherwise entitled to - how to reach the data protection officer The interview is voluntary. We do not treat silence as consent. Sensitive personal data, as the Act defines it, needs written consent from the person (section 24(1)(a)), unless another condition in that section truly applies. If the instrument collects health, ethnicity or other sensitive data, the capture method has to record that written consent. We will not hide a sensitive module inside an oral yes to save time. Providing answers is not compulsory under a general law just because a donor funded the study. The script says so. ## Devices, access, and agreements Interview devices are encrypted. Access to a case is limited to the enumerator assigned to it, that enumerator's supervisor, and the named project manager. The myVoice field collector has those three roles. When a person leaves the job, their access is removed. Interviewers do not keep a personal copy of the file after handover. Google Workspace field dashboards, where we use them, are limited to the named project team. They are a progress view, not a public map. Every interviewer signs a confidentiality agreement before fieldwork. The agreement covers respondent identities, locations and answers, and it continues after the contract ends. Supervisors sign the same style of agreement. Paper forms, when the mode is PAPI, are stored while they are being keyed and then disposed of with the electronic file on the written disposal date. A lost form is treated as a security incident. ## If something goes wrong A security breach that affects, or may affect, personal data is reported to the Information Commissioner within **72 hours** of Balcostics becoming aware of it. That duty is in section 21(3) of the Act. The report includes the facts, the nature of the breach, the categories and approximate numbers of people and records, the measures taken or proposed, the consequences, and the data protection officer's name and contact details (section 21(4)). We also tell each person whose personal data is affected, without undue delay. The Act leaves the form and timing of that notice to regulations. The notice tells the person the nature of the breach, what we are doing about it, and how to reach the data protection officer. Where you are the controller and we are the processor, we tell you as soon as we know, and we help you make the Commissioner report. The clock starts when we become aware of a breach that affects or may affect personal data. We do not use the 72 hours to decide whether the duty exists. We keep a record of breaches and of what we did. ## Transfers The dataset goes to the client by the method in the contract. That method is agreed before fieldwork. Usual working files are CSV, SPSS and Stata, limited to the variables the contract allows. If the file leaves Jamaica, the eighth standard applies (section 31). The destination must give adequate protection, or a listed case must apply, such as the data subject's consent, a contract the person asked for, or terms the Commissioner has approved. A foreign prime contractor is not, by itself, proof that the destination country is adequate. The contract has to name the basis. We do not paste project microdata, respondent lists or transcripts into a public generative-AI chat. Open-answer sentiment on myVoice is a separate product feature. It calls an external AI model, and the export still excludes names and email addresses. Field files do not go through that feature. ## Retention and disposal Personal data for a survey is kept only as long as the purpose needs, and the contract states a disposal date (the fifth standard, section 28). Our practice: - Respondent-level field files are kept until the written disposal date in the contract, then disposed of. - We review files so that data no longer needed for the purpose, for an access request, for a legal claim, or for a legitimate purpose tied to the sector, goes into the disposal queue. - If the data were used to make a decision about a person, we keep them long enough after that decision for the person to ask for access (Disposal Regulations, regulation 2(1)(c)), and then we dispose of them. - Website enquiries follow a different clock: 24 months, stated in the [privacy notice](/privacy/). Disposal means the data can no longer be processed and can no longer identify or be linked to the person. For electronic files the method has to be permanent given reasonably foreseeable technology (regulation 2(2)). Renaming a folder is not disposal. We keep a short retention note on each job: minimum period, maximum period, and disposal date. That is the policy regulation 2(1)(b) asks a controller to have. Where you are the controller, your retention schedule governs if it meets the Act. Where you have none, we write a date into the contract rather than keep the file with no end. ## Our registration and the DPO Balcostics Limited is registered with the Office of the Information Commissioner under the Data Protection Act 2020. The registration fee is not yet payable. The data protection officer is **Abi-Gaye White-Thomas**. Contact her at the Mandeville address above, at [research@balcostics.com](mailto:research@balcostics.com), or on (876) 964-4046 or (876) 314-4543. Use the subject line "Data protection". Complaints can also go to the Office of the Information Commissioner, Masonic Building, 2nd Floor, 45-47 Barbados Avenue, Kingston 5, [oic.gov.jm](https://oic.gov.jm), info@oic.gov.jm, (876) 920-4390. A short account of the company, the panel size and the jobs is on the [facts](/facts/) page. ## At a glance - Controller: Balcostics Limited, unless the contract names you - DPO: Abi-Gaye White-Thomas - Breach report: Commissioner within 72 hours; affected people without undue delay - Devices: Encrypted; named access only - Disposal: Disposal of Personal Data Regulations, 2024 Source: https://balcostics.com/data-protection/