General AI Checklist

Summary

This is a practical self-assessment checklist published by the Jersey Office of the Information Commissioner (JOIC) to help organisations work through data protection issues before deploying an AI system that processes personal data. It is a form/tool rather than a binding rule, but it maps each check to underlying obligations under the Data Protection (Jersey) Law 2018 (DPJL 2018), covering the full lifecycle from initial use-case definition through to decommissioning.

• Scope and mapping: Identify AI features (including embedded/default AI in everyday software), map what personal and special category data is processed, and assess high-impact contexts such as employment, finance, health or vulnerable individuals.
• Lawful basis and fairness: Document a Schedule 2 Part 1 lawful condition (and Part 2 condition if special category data is involved), assess compatibility with original purpose, and evaluate fairness and reasonable expectations.
• Transparency and automated decisions: Update privacy notices before deployment, explain AI use and logic to individuals, and ensure meaningful human oversight of decisions with legal or significant effects.
• DPIA and risk: Complete a DPIA before high-risk processing, involve the DPO, and consult the JOIC before processing starts if high risk remains unmitigated.
• Data handling and rights: Apply data minimisation and defined retention, ensure AI outputs can be located for DSARs/complaints, and plan for rectification, erasure and model-training deletion issues.
• Security, suppliers and transfers: Assess AI-specific security risks, put processor agreements in place, check international transfer mechanisms, and set up an incident response process, including breach notification to JOIC normally within 72 hours.
• Governance and monitoring: Assign a senior accountable owner, train staff, control shadow AI use, obtain sign-off from business, security, DPO and procurement leads, and monitor/reassess the system throughout its lifecycle including on decommissioning.

The checklist itself does not create new legal duties beyond those already in the DPJL 2018, but it operationalises those duties into a documented approval workflow (tick boxes, evidence/notes, sign-off table and final deployment decision) that organisations can use to demonstrate accountability.

Key obligations

• Complete a Data Protection Impact Assessment (DPIA) before processing likely to result in high risk, and before procurement, configuration or deployment is finalised
• Consult the JOIC before processing starts if the DPIA identifies high risks that cannot be adequately mitigated
• Notify the JOIC of AI-related personal data breaches likely to affect individuals' rights and freedoms, normally within 72 hours
• Identify and document a lawful condition under Schedule 2 Part 1 of the DPJL 2018 before AI processing of personal data begins
• Identify and document the applicable Schedule 2 Part 2 condition where special category data is processed or inferred by an AI system
• Update the relevant privacy notice before deployment to explain AI use, purposes, data categories, and decision logic
• Ensure meaningful human involvement and review before any solely automated decision with legal or similarly significant effects, and provide individuals a route to contest such decisions
• Put a written data processing agreement in place where an AI supplier acts as a processor
• Implement an appropriate international transfer mechanism before deployment where personal data will be transferred outside Jersey
• Define and technically implement retention periods for AI inputs, prompts, logs, and outputs, and update records of processing activities

Applies to

organisations acting as data controllers, employers, businesses using AI in HR, customer analytics, complaint handling and embedded workplace tools, AI suppliers/processors

Deadlines

• normally within 72 hours: Notification to the JOIC of AI-related data breaches likely to affect individuals' rights and freedoms