Transferring people's data outside the Bailiwick

Summary

This is general guidance from the Office of the Data Protection Authority (Guernsey) explaining what counts as a 'data transfer' outside the Bailiwick and pointing organisations to more detailed guidance documents and tools. It applies to any organisation or individual based in the Bailiwick of Guernsey that processes personal data, including where data is sent overseas via everyday tools such as email marketing platforms, social media pages, or overseas service providers.

• Data transfer vs data sharing: Clarifies that a 'data transfer' (moving data outside the Bailiwick geographically) is distinct from 'data sharing' (giving a third party access to data).
• Destination-dependent rules: Different rules apply depending on whether data is sent to EU/EEA member states or 'adequate' third countries, versus the rest of the world.
• Related guidance referenced: Points to three further resources: step by step Guidance on International Data Transfers, a Transfer Impact Assessment self-assessment tool, and the Bailiwick of Guernsey Addendum to the EU Commission's Standard Contractual Clauses.
• Law enforcement processing: Notes that transfers of personal data for law enforcement purposes under the Law Enforcement Ordinance follow different statutory mechanisms, set out in sections 43 to 47 of that Ordinance, rather than the Data Protection Law.

The page does not itself impose new rules but directs organisations considering an international data transfer to consult the underlying Data Protection (Bailiwick of Guernsey) Law, 2017, the linked detailed guidance, or their data protection officer or legal adviser for specific circumstances.

Applies to

organisations and individuals based in the Bailiwick of Guernsey that process personal data, data controllers considering transferring personal data outside the Bailiwick, entities processing personal data for law enforcement purposes under the Law Enforcement Ordinance