ODPA Guidance on registration

Summary

This is general guidance from the Office of the Data Protection Authority (Guernsey) explaining who must register as a data controller or processor under the Data Protection (Bailiwick of Guernsey) Law, 2017, and how the annual registration and levy system works. It covers who is caught by the law, what counts as personal and special category data, registration fees, and specific scenarios such as landlords, sole traders, companies, branches of overseas entities, and businesses in closure.

• Who must register: Any controller or processor established in the Bailiwick who processes personal data for purposes other than purely personal/household affairs must register, unless the domestic purposes exemption applies.
• Registration fees for 2027: £2,595.82 annual levy for organisations with 50+ FTE staff; £64.90 for organisations with 0-49 FTE staff; £0 for charities and not-for-profit organisations.
• Levy Collection Agents: GFSC-regulated organisations may act as Levy Collection Agents to declare and pay levies on behalf of other controllers/processors.
• Companies and branches: Companies (including dormant, asset-holding or closing companies) generally must register unless all directors are corporate directors and no other processing occurs; Bailiwick branches of overseas parents, and non-Bailiwick entities using a Bailiwick-based processor, may also need to register.
• Updating or cancelling registration: Registrants can amend, transfer, or cancel their registration via their ODPA online account, or contact the ODPA registrations team for assistance.

The guidance is informational and explanatory rather than a standalone legal instrument, but it restates binding obligations arising from the 2017 Law, including the duty to register and to keep registration details current.

Key obligations

• Entities established in the Bailiwick that process personal data for non-domestic purposes must maintain an annual registration with the ODPA (directly or via a Levy Collection Agent) and pay the applicable levy.
• Registered controllers and processors must notify the ODPA of any changes to their registration details within 28 days of the change (preferably as soon as practicable).
• Fee amount payable must be calculated based on total full-time-equivalent (FTE) employees, including those located outside the Bailiwick where relevant.
• Commercial businesses, companies in liquidation/dormancy, and branches of overseas organisations must continue to maintain registration for as long as they process or retain personal data.

Applies to

controllers, processors, landlords, sole traders, small businesses, companies (including dormant and asset-holding companies), charities and not-for-profit organisations, branches of overseas organisations, Levy Collection Agents (GFSC-regulated entities), fund/fiduciary administrators and administered entities, non-executive directors in the finance industry

Deadlines

• 28 days: Registered controllers and processors must notify the ODPA of any changes to their registration within 28 days of the change.
• January 2027: Increased registration levies (approved by the Committee for Home Affairs) take effect for 2027.