Enforcement Order issued to Watches of Switzerland Company Limited (2025-08-20)

Summary

This is a public enforcement notice from the Guernsey Data Protection Authority describing an enforcement order issued against Watches of Switzerland Company Limited (WoS) following a breach of section 15 (Right of Access) of the Data Protection (Bailiwick of Guernsey) Law, 2017. The breach arose from an inadequate search process when responding to a Data Subject Access Request (DSAR), which caused relevant personal data to be omitted from disclosure to the complainant.

• What went wrong: WoS failed to locate and disclose all personal data responsive to a DSAR, including material relating to an internal decision-making process, because its search did not cover sources such as local branch staff or historic/archived records.
• Enforcement order requirements: WoS must perform a further search for relevant material and provide the complainant with all information they were entitled to under their original DSAR, and must review its systems and internal DSAR process to ensure all relevant personal data is captured in future requests.
• Mitigating factor: The Authority noted WoS proactively began updating its internal DSAR process after being notified of the proposed determination, and commended this engagement.

While this order is specific to WoS, the Authority frames it as broader guidance for organisations on conducting sufficiently thorough searches when responding to DSARs, understanding what constitutes personal data, and reviewing processes when a data subject raises post-disclosure concerns.

Key obligations

• WoS must perform a further search for relevant material relating to the complainant's DSAR and provide the complainant with all information to which they were entitled in their original DSAR.
• WoS must review its systems and internal DSAR process to ensure all relevant personal data is captured in future DSARs.

Applies to

data controllers, retail/commercial organisations handling personal data