Data Protection (General Provisions) (Bailiwick of Guernsey) Regulations, 2018

Summary

These Regulations, made under the Data Protection (Bailiwick of Guernsey) Law, 2017, set out the detailed operational rules for registration, levies, record-keeping and certain authorised processing and transfers of personal data in Guernsey, Alderney and Sark. They apply to data controllers and processors, including a category of financial services and fiduciary businesses acting as levy collection agents for smaller entities.

• Registration: Controllers and processors must register with the Authority unless exempt (e.g. occasional, non-large-scale, non-high-risk processing, or an exempt small entity using a levy collection agent); applications must include prescribed details and the registration fee set out in Schedule 1.
• Notifications and returns: Registered controllers and processors must notify the Authority of changes to their register particulars; levy collection agents must make annual returns (regulation 5A); other controllers and processors were required to make a return in 2021 (regulation 5B).
• Levies: Registered controllers and processors must pay annual levies; levy collection agents must issue administered entities a certificate of exemption and keep records of those entities.
• Record-keeping: Controllers and processors must keep records of processing activities (with a limited exemption for small-scale operations) for the periods specified in the Regulations.
• Authorised processing and transfers: Specified persons may process personal data (including certain special category data) for specified purposes under conditions in Schedule 2, and the Guernsey Financial Services Commission or International Stock Exchange Authority may transfer personal data to unauthorised jurisdictions under conditions in Schedule 3.
• Exemptions and disapplications: The Regulations amend Schedule 8 to the Law to add further exemptions/exceptions (Schedule 4) and disapply section 16(2)-(4) of the Law for certain education, health and social assistance disclosures (Schedule 5), subject to a vital-interest safeguard.
• Transitional provisions: The former register of controllers continues under the new Law; controllers previously notified under the old law are deemed temporarily registered until the first anniversary of their previous notification; a transitional exemption from registration for previously unnotified processors/controllers (excluding high-risk processing) expired on 25th May 2019.

The Regulations have been amended multiple times since 2018, notably to introduce the levy collection agent regime and related returns and record-keeping duties with effect from 1st January 2021, and remain in force as consolidated.

Key obligations

• Controllers and processors must register with the Authority unless an exemption applies, including providing prescribed application information and paying the registration fee in Schedule 1
• Registered controllers and processors must notify the Authority of necessary changes to their register particulars
• Levy collection agents must make annual returns to the Authority (regulation 5A)
• Other controllers and processors were required to make a return in 2021 (regulation 5B)
• Registered controllers and processors must pay annual levies (regulation 6)
• Levy collection agents must give administered entities a certificate of exemption (regulation 6A)
• Levy collection agents must keep records of their administered entities (regulation 6B)
• Controllers must keep records of processing activities (regulation 7)
• Processors must keep records of processing activities (regulation 8)
• Records of processing activities must be retained for the period specified in regulation 10

Applies to

controllers, processors, levy collection agents, licensed fiduciaries, licensed institutions (banks), licensed insurers, licensed insurance intermediaries and managers, registered non-regulated financial services businesses, licensed investment businesses, partnerships, companies, foundations, limited liability partnerships, limited partnerships

Deadlines

• 25th May, 2018: Commencement date of the Regulations
• 25th May, 2019: Expiry of the transitional exemption from registration for previously unnotified controllers/processors (regulation 17), except for high-risk processing
• 1st January, 2021: Effective date of amendments introducing the levy collection agent regime, related registration exemptions, and annual/2021 return requirements
• first anniversary of previous notification under the former law: Date until which controllers notified under the former Data Protection Law, 2001 are deemed temporarily registered under the new Law, unless registered earlier

Related documents

• This document amends Data Protection (Bailiwick of Guernsey) Law, 2017 (Consolidated text)
• This document is made under Data Protection (Bailiwick of Guernsey) Law, 2017 (Consolidated text)
• This document is made under Data Protection (Law Enforcement and Related Matters) (Bailiwick of Guernsey) Ordinance, 2018
• Data Protection (General Provisions) (Bailiwick of Guernsey) (Amendment) Regulations, 2024 amends this document