Data Protection (Jersey) Law 2018

Summary

This is Jersey's principal data protection statute, replacing the 2005 Law and implementing GDPR-equivalent standards for the Island. It sets out the core data protection principles, the duties of controllers and processors, the rights of data subjects, exemptions, cross-border transfer rules, and enforcement powers, and establishes the Jersey Office of the Information Commissioner's regulatory framework.

• Controller duties: General accountability obligations, lawful and fair processing, data protection by design/default, record-keeping, and data protection impact assessments for high-risk processing.
• Processor duties: Security obligations, processing only on documented instructions, and joint security duties with controllers.
• Data protection officer: Requirement to appoint a DPO in prescribed circumstances, with defined position and duties.
• Data subject rights: Rights of access, rectification, erasure, restriction, portability, objection to processing (including direct marketing), and rights regarding automated decision-making.
• Breach notification: Controllers must notify the Authority of personal data breaches.
• Cross-border transfers: Personal data may only be transferred outside Jersey subject to general principles and appropriate safeguards, with listed exceptions (Schedule 3).
• Exemptions: Wide-ranging exemptions from transparency and subject-rights provisions for areas such as national security, crime and taxation, corporate finance, trusts, legal privilege, and journalistic/academic/artistic material.
• Enforcement and remedies: Proceedings against controllers, a right to compensation for data subjects, and criminal offences including unlawful obtaining of personal data, false information, and obstruction.

The Law has been amended multiple times since 2018 (most recently with changes commencing 1 April 2026, 1 September 2026 and 2 October 2026), chiefly to update definitions, transfer functions between ministers, and align exemptions with related legislation such as the Cyber Security (Jersey) Law 2026 and the Bank (Recovery and Resolution) (Jersey) Amendment Law 2025. Most of the Law's substantive provisions have been in force since 25 May 2018, with Part 5 (Data Protection Officer) commencing 25 November 2018 and Articles 17 and 18 (prior consultation for high-risk processing) commencing 25 May 2019.

Key obligations

• Controllers must comply with the data protection principles and demonstrate accountability under Article 8.
• Controllers must ensure processing has a lawful basis and is fair and transparent, providing required information to data subjects.
• Controllers must keep records of processing activities and comply with the Law generally (Article 14).
• Controllers must implement data protection by design and by default.
• Controllers must conduct a data protection impact assessment for high-risk processing and consult the Authority where prior consultation is required.
• Controllers must appoint a data protection officer where required and ensure the DPO's independent position and duties are respected.
• Controllers and processors must implement appropriate security measures for personal data (Article 21) and processors must comply with general processing obligations under contract with the controller.
• Controllers must notify the Authority of personal data breaches.
• Controllers must handle data subject requests (access, rectification, erasure, restriction, portability, objection) in accordance with the prescribed procedures and time limits.
• Transfers of personal data outside Jersey must comply with the general principles for cross-border transfers and be subject to appropriate safeguards unless an exception in Schedule 3 applies.

Applies to

controllers, processors, data protection officers, public authorities, scheduled public authorities, credit reference agencies, health professionals

Deadlines

• 25 May 2018: General commencement date of the Data Protection (Jersey) Law 2018.
• 25 November 2018: Commencement of Part 5 (Data Protection Officer provisions).
• 25 May 2019: Commencement of Articles 17 and 18 (prior consultation requirements for high risk processing and legislation).