Template Data Protection Statement

Summary

This is a template privacy notice published by the Jersey Office of the Information Commissioner (JOIC) for organisations to adapt for their own websites. It illustrates how a data controller might explain, in a customer facing statement, what personal data it collects, why, and what rights individuals have under the Data Protection (Jersey) Law 2018 (DPJL 2018). It is a drafting aid, not itself a binding rule, and must be tailored to the organisation's actual data practices before use.

• Scope and collection: Sample wording covering what the statement applies to and what personal data is collected (name, email, contact reason, location and website usage data) and how it is collected directly and indirectly.
• Purposes and lawful basis: Template tables mapping processing purposes (responding to queries, customisation, analytics, security, statistics) to lawful bases under DPJL 2018 (consent, legitimate interests, legal obligation, contract).
• Marketing and sharing: Sample clauses stating personal data will not be used for marketing and listing categories of recipients (professional advisers, regulators, service providers such data hosts and website hosts).
• Retention and international transfers: Placeholder wording on retention periods and on transferring personal data outside Jersey, with a commitment to notify individuals of changes to transfer destinations or mechanisms.
• Cookies: Example cookie table and explanatory text describing types of cookies used and how individuals can manage browser cookie settings.
• Individual rights: Standard descriptions of the rights to access, correction, erasure, restriction, portability, objection, and protection from solely automated decision making, and the right to withdraw consent.
• Security and complaints: Sample statements on security measures, breach notification, and the right to complain to the organisation or to the Jersey Office of the Information Commissioner.

Because this is a template rather than an enforceable instrument, it creates no direct legal obligations on its own; any obligations arise from the underlying DPJL 2018 once an organisation adapts and publishes its own version of the statement.

Applies to

data controllers operating websites in Jersey