Administered Registrations

Summary

This JOIC guidance explains how data protection registration and charges apply to structures administered by trust company businesses (TCBs) and fund services businesses (FSBs) in Jersey, such as companies, trusts, foundations, private trust companies, family offices, JPUTs, cell companies and SPVs. It clarifies who counts as a Controller or Processor under the Data Protection (Jersey) Law 2018, when such entities are treated as 'established' in Jersey, and how the £50 reduced administered-registration fee under Regulation 6B of the Data Protection (Registration and Charges) (Jersey) Regulations 2018 operates.

• Registration duty: Any controller or processor established in Jersey must register with the JOIC before processing personal data; processing without registration is a criminal offence under Article 17 of the DPAJL 2018.
• Administered registration option: A TCB or FSB may include a client entity on its 'administered' list, which qualifies the entity for a reduced £50 annual charge instead of the standard revenue/size-based fee, but there is no obligation to use this route.
• Responsibility remains with the entity: Ultimate responsibility for registration and accuracy of particulars stays with the Controller or Processor itself, not the administering TCB/FSB, even where the TCB/FSB handles the registration.
• Avoiding duplicate registration: Where an entity receives administration services from more than one TCB/FSB, the parties must contractually clarify which one is responsible for registration to avoid being registered and charged more than once.
• New entities: Newly formed controllers or processors must register at or before the point of incorporation, regardless of whether they are administered.
• Notifying changes: Registered controllers and processors must notify the JOIC of any change to their registration particulars as soon as practicable and in any event within 28 days of the change, per Article 4(1) of the DPRCJR 2018.

The guidance also sets out illustrative categories of records (e.g. statutory registers, UBO records, security interest records) that are treated as limited processing activities for administered companies and foundations, and notes that an administrator may itself be both a controller and a processor depending on the function performed.

Key obligations

• Controllers and processors established in Jersey must register with the JOIC before causing or permitting personal data to be processed, including registering at or before the point of incorporation for newly formed entities.
• Registered controllers and processors must pay the applicable annual charge to the Authority unless a specific exemption applies.
• Registered controllers and processors must notify the JOIC of any change to their registration particulars as soon as practicable and in any event within 28 days of the change.
• Where an entity is administered by more than one TCB/FSB, the parties must clarify by contract which one is responsible for undertaking the data protection registration to avoid duplicate registration and charges.
• A TCB or FSB wishing to use the £50 administered-registration charge for a client must ensure the client entity is properly included on its administered list rather than pursuing full individual registration.

Applies to

trust company businesses, fund services businesses, Jersey registered companies, trusts and foundations, private trust companies, family offices, JPUTs, foreign entities, cell companies, SPVs, data controllers, data processors

Deadlines

• within 28 days of the change: Registered controllers and processors must notify the JOIC of any change to their registration particulars as soon as practicable and in any event within this period.
• at or before the point of incorporation: Newly formed controllers or processors must be registered with the JOIC before any processing activity commences.