Everything You Need to Know About ODPA Registration and Levy

Summary

This guidance from the Office of the Data Protection Authority (ODPA) explains the registration and levy regime that has applied since 2021 to controllers and processors established in the Bailiwick of Guernsey who process personal data. It sets out who must register, how much they must pay, and the two available registration routes: registering directly with the ODPA or via an ODPA Levy Collection Agency (LCA).

• Who must register: Any sole trader, legal person, organisation, business, charity or landlord established in the Bailiwick that processes personal data outside of purely personal or household affairs.
• Levy amounts: £2,488.80 per year for organisations with 50 or more full-time-equivalent (FTE) staff; £62.22 per year for all other organisations; £0 for registered charities and not-for-profit organisations.
• Registration and renewal window: Registration and annual renewal must occur during January to February each year, rather than at any point in the year.
• Who must register directly (cannot use an LCA): Controllers or processors with 50+ FTEs, those legally required to appoint a Data Protection Officer, entities acting as an ODPA Levy Collection Agent, and charities, not-for-profits and States of Guernsey Deputies (who pay nothing but must still register).
• New businesses: A business set up mid-year need not register immediately unless it has 50+ FTEs, must appoint a DPO, acts as an LCA, or is a non-profit; otherwise it can arrange LCA payment by 31 December of its first trading year or register directly the following January-February.
• Levy Collection Agents: Only organisations registered with or regulated by the Guernsey Financial Services Commission (GFSC) may act as LCAs, declaring and paying levies on behalf of other controllers/processors and maintaining records available to the ODPA on request.

The document is informational guidance restating existing statutory registration and levy requirements under the Data Protection (Bailiwick of Guernsey) Law, 2017 and related regulations; it does not itself create new legal obligations beyond those already in force.

Key obligations

• Controllers and processors established in the Bailiwick who process personal data (outside personal/household use) must register with the ODPA and pay the applicable annual levy during January-February each year.
• Registered entities must review and renew their registration and pay the appropriate levy annually during January-February.
• Charities and not-for-profit organisations must complete the registration process annually during January-February, but are not required to pay the levy.
• Organisations with 50+ FTE staff, those required to appoint a Data Protection Officer, and those acting as an ODPA Levy Collection Agent must register directly with the ODPA rather than through an LCA.
• A new business meeting any of the four listed criteria (50+ FTEs, DPO requirement, acting as an LCA, or being a non-profit) must register directly with the ODPA when it first sets up.
• A new business not meeting those criteria that wishes to use a Levy Collection Agent must set this up by 31 December of its first year of trading, or otherwise register directly during the following January-February.
• Levy Collection Agents must maintain records (including company name) of each controller or processor they pay on behalf of and make these available to the ODPA upon request.

Applies to

controllers, processors, sole traders, charities and not-for-profit organisations, ODPA Levy Collection Agents (LCAs), organisations required to appoint a Data Protection Officer, States of Guernsey Deputies

Deadlines

• January-February of each year: Annual window during which controllers/processors and charities/not-for-profits must register or renew registration and pay any applicable levy.
• 31 December of first year of trading: Deadline for a new business (not required to register directly) to set up payment via an ODPA Levy Collection Agent.