Investigation Process

Summary

This ODPA guidance describes the step by step process followed when the Authority investigates a complaint or conducts an inquiry into an organisation's handling of personal data under Guernsey's data protection Law. It sets out what an organisation under investigation can expect, including notice, information requests, periodic updates, and the process for determinations and sanctions.

• Notice and information requests: Organisations receive formal notice of a complaint or inquiry, which may include initial questions, and may be asked to provide further information.
• Status updates: Organisations are updated on the status, and where appropriate the outcome, of the investigation every three months.
• No further action: If no grounds for further action are found, the organisation is informed.
• Proposed determination: If the ODPA decides to make a determination, it provides written notice of the proposed determination and reasons.
• Representations on breach determination: If a breach is found, the organisation has 28 days to make representations before a final determination is issued.
• Sanctions: Available sanctions under the Law are a reprimand, a warning, an order, or a fine; sanctions must be proportionate and effective.
• Representations on enforcement order: If an enforcement order (including a fine) is proposed, the organisation has 28 days to make representations before a final enforcement order is issued, and has a right of appeal.
• Public statement: At the conclusion of the investigation or inquiry, the Authority may issue a public statement under Section 64 of the Law.

This is a procedural overview rather than a source of new legal obligations, but organisations under investigation must respond to ODPA requests and observe the representation periods described to preserve their ability to contest findings and enforcement action.

Key obligations

• Organisations under investigation must respond to the ODPA's questions or provide requested information when asked.
• An organisation found to have breached the Law has 28 days from written notice of a proposed determination to make representations before a final determination is issued.
• An organisation subject to a proposed enforcement order (including a fine) has 28 days to make representations before the final enforcement order is issued.

Applies to

organisations subject to investigation or inquiry (data controllers/processors), individuals making complaints

Deadlines

• every three months: Organisations are updated on the status and outcome of the investigation.
• 28 days: Period to make representations after notice of a proposed determination that a breach has occurred, before the final determination is issued.
• 28 days: Period to make representations after notice of a proposed enforcement order (including a fine), before the final enforcement order is issued.