Following ODPA investigation into IT outage, SoG confirms completion of recommendations (2025-02-12)

Summary

This is a public statement issued by the Guernsey Data Protection Authority (ODPA) under section 64 of the Data Protection (Bailiwick of Guernsey) Law, 2017. It reports the outcome of an inquiry into the Policy and Resources Committee (P&R) of the States of Guernsey following IT outages between November 2022 and January 2023 that disrupted access to personal data.

• Findings: The Authority found P&R breached section 41(2)(b) by failing to maintain the resilience of processing systems (notably an unmaintained air conditioning unit in a data room) and breached section 41(2)(c) by having no IT disaster recovery plan in place at the time of the outages.
• Remediation: P&R was required to report on progress implementing recommendations from PwC's Major Incident Review action plan; the Authority confirms all recommendations have now been completed.
• Sanction: Because the action plan was completed, the Authority issued a Reprimand rather than an enforcement order compelling remedial action.
• Appeal route: Under section 84 of the Law, a controller or processor may appeal a determination to the Court within 28 days of its issuance.

The statement is primarily informational, closing out a completed enforcement inquiry, but it restates the underlying legal duty on controllers and processors under section 41 to secure personal data through resilient systems and effective disaster recovery planning, and highlights lessons for other organisations on risk mitigation and system resilience.

Key obligations

• Controllers and processors must take reasonable steps to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services (section 41(2)(b)).
• Controllers and processors must have and retain the ability to restore availability of and access to personal data in a timely manner following a physical or technical incident, including maintaining an IT disaster recovery plan (section 41(2)(c)).
• A controller or processor wishing to appeal an Authority determination must lodge the appeal with the Court within 28 days of the determination's issuance (section 84).

Applies to

controllers, processors, States of Guernsey committees (public authority controllers)

Deadlines

• within 28 days of the issuance of the determination: Deadline for a controller or processor to appeal an Authority determination to the Court under section 84 of the Law.