Guidance for Administrators and Administered Entities

Summary

This is ODPA guidance explaining when administered entities (such as SPVs, companies, trusts, partnerships and foundations) and their administrators (fund administrators, fiduciary administrators, insurance managers, family offices) must register under the Data Protection (Bailiwick of Guernsey) Law, 2017. It clarifies the 'established in the Bailiwick' and 'processing personal data' tests, sets out the very narrow exceptions, and explains the registration and levy mechanics, including the Levy Collection Agent (LCA) route.

• Who must register: Any controller or processor established in the Bailiwick that processes personal data via a manual or electronic filing system, unless a narrow exemption applies (domestic-purpose-only processing, no personal data processed at all, or truly occasional/non-systematic processing).
• Entities without legal personality: For trusts, general partnerships and limited partnerships without separate legal personality, the trustee(s), partners or general partner must register in their own name, not the entity's name.
• Registration routes: Register directly with the Authority (Route 1), or authorise a licensed service provider to act as Levy Collection Agent (Route 2), though direct registration is mandatory for certain categories.
• Mandatory direct registration: Controllers/processors with 50+ FTE employees, those required to appoint a Data Protection Officer, organisations acting as an LCA, and charities/not-for-profits/Bailiwick elected officials (who pay no levy) must register directly and cannot use an LCA.
• Annual obligations: Registered entities must submit an annual return to the Authority during January to February each year and pay an annual levy.
• LCA duties: An LCA must issue a certificate of exemption to each entity it pays the levy for within one month of paying that levy, and must retain records (name of controller/processor, copy of certificate, date issued) for 6 years from the return date.
• Accountability: Legal responsibility and liability for data protection compliance remain with the appointing entity even where an LCA is used; failure to register when required is a criminal offence and unpaid levies may be recovered as a civil debt.

The guidance stresses that registration is strongly recommended in cases of doubt, that no refunds are given for mistaken dual registration (as of January 2023), and directs readers to contact the ODPA or consult more detailed guidance for specific questions.

Key obligations

• Controllers and processors established in the Bailiwick that process personal data must register with the ODPA unless an exemption applies.
• Registered entities must submit an annual return to the Authority during January to February each year.
• Registered entities must pay an annual levy to the Authority.
• Entities with 50+ FTE employees, those required to appoint a Data Protection Officer, organisations acting as an LCA, and charities/not-for-profits/elected officials must register directly with the Authority rather than via an LCA.
• Where an entity lacks separate legal personality (trust, general partnership, limited partnership without legal personality), the trustee(s), partners or general partner must register in their own name.
• A Levy Collection Agent must issue a certificate of exemption to each entity it has paid the levy for within one month of paying the annual levy.
• A Levy Collection Agent must maintain accurate records of each controller/processor it pays levy for, including the certificate of exemption and date issued, retained for 6 years from the return date.
• An entity must be clear whether it is registering directly or via an LCA and avoid duplicate registration.

Applies to

administrators, fund administrators, fiduciary administrators, insurance managers, family offices, administered entities, special purpose vehicles (SPVs), companies (including cell companies and holding companies), limited partnerships with separate legal personality (LP Incs), limited liability partnerships (LLPs), foundations, trusts, partnerships, limited partnerships without separate legal personality, controllers, processors, Levy Collection Agents, charities and not-for-profit organisations, Bailiwick elected officials

Deadlines

• January-February of each year: Annual return must be submitted to the Authority during this period each year.
• within one month of paying its annual levy: A Levy Collection Agent must give a certificate of exemption to each entity for whom it has paid the annual levy.
• 6 years from the return date: Levy Collection Agents must retain records relating to the controllers/processors they pay levy for.