Statutory referrals to the ODPA

Summary

This guidance page from the Office of the Data Protection Authority (Guernsey) explains the specific sections of the data protection Law under which organisations or public bodies must, or may, engage with the Authority for consultation, approval or accreditation. It does not create new rules but points readers to existing statutory referral points and invites contact with the ODPA for further assistance.

• Section 45: Prior consultation with the Authority is required where a data protection impact assessment identifies high risk processing.
• Section 46: Public committees or public authorities of the Bailiwick proposing high risk legislation must consult the Authority before making or recommending it.
• Section 52: The Authority may approve codes of conduct prepared by bodies representing categories of controllers or processors.
• Section 53: The Authority may accredit a monitoring body to oversee compliance with an approved code of conduct.
• Section 57: The Authority may specifically authorise certain personal data transfers.
• Section 58: The Authority may approve binding corporate rules (BCRs) used by controllers or processors for transfers of personal data, including to unauthorised jurisdictions.

The page is informational and directs organisations to contact the ODPA directly for guidance or to initiate any of these statutory processes; it does not itself set out procedures, forms or timelines.

Key obligations

• Controllers or processors must consult the Authority under section 45 where a data protection impact assessment shows high risk processing.
• Public committees or public authorities proposing high risk legislation must consult the Authority under section 46 before making or recommending such legislation.

Applies to

data controllers, data processors, public committees, public authorities of the Bailiwick