Registration

Summary

This JOIC guidance explains the statutory registration scheme for data controllers and processors established in Jersey under the Data Protection (Jersey) Law 2018 and the Data Protection (Registration and Charges) (Jersey) Regulations 2018. It covers who must register, how to register and renew, when registration charges apply, how those charges are calculated, and the consequences of failing to register, update, or pay.

• Who must register: All data controllers and data processors established in Jersey must register before processing personal data, unless an exemption applies (e.g. purely personal/domestic processing, non-personal data, or national security processing).
• Registration charge: Registered controllers/processors must pay an annual charge unless exempt (public authorities, election candidates, provided schools, dormant/ceased businesses, non-profits). The charge depends on full-time equivalent employee numbers, prior-year revenue, whether the organisation is JFSC-registered and conducts financial services business under the Proceeds of Crime (Jersey) Law 1999, and whether it processes special category data; charges range from £70 to £1,600, with an extra £50 per administered entity for trust company/fund services businesses.
• Annual renewal: Registrations expire on 31 December each year; the renewal window runs from 1 January to the last day of February, by which renewal and payment must be completed.
• Keeping details current: Any change to registration details, or a decision to stop processing personal data, must be notified/updated within 28 days; deregistration can only occur once a registered company is dissolved on the JFSC registry.
• Consequences of non-compliance: Processing personal data without registering, or failing to keep a registration up to date, is a criminal offence; failure to pay the registration charge can result in removal from the Register, after which the entity may no longer lawfully process personal data.

The guidance also sets out detailed definitions (controller, processor, DPO, special category data, FTE calculation, 'established', public authority, non-profit, provided school, trust company/fund services business) used to determine registration and charge obligations, and clarifies that administered entities need not be separately registered if already registered themselves.

Key obligations

• All controllers and processors established in Jersey must register with the Authority before processing personal data, unless an exemption applies.
• Registered controllers/processors must pay the applicable registration charge unless exempt.
• Registrations must be renewed annually; renewal and payment must be completed within the renewal window (1 January to the last day of February) or the registration will expire.
• Any change to registration details (including correspondence email address) must be notified/updated within 28 days of the change.
• If registration is no longer required, the Authority must be informed and deregistration completed as soon as possible, and at the latest within 28 days of the change (subject to the entity being dissolved if it is a company on the JFSC registry).
• Transfer of the person responsible for managing a registration must be actioned, with the registration number and security code shared and details updated, within 28 days of the change.
• For new registrations, the registration charge must be paid within one month of submission; for renewals, by the last day of February each year.
• Failure to pay the registration charge or keep registration details up to date can lead to removal from the Register, after which further processing of personal data is a criminal offence.

Applies to

data controllers, data processors, trust company businesses, fund services businesses, public authorities (exempt), non-profit organisations (exempt), provided schools (exempt), candidates for election (exempt)

Deadlines

• 31 December each year: Registrations expire on this date annually.
• 1 January to the last day of February: Annual renewal window during which registration renewal and charge payment must be completed.
• within 28 days of the change: Deadline to notify the Authority of changes to registration details, to deregister, or to transfer management of a registration.
• last day of February each year: Deadline for payment of the registration charge for renewing registrations.
• one month after the registration is submitted: Deadline for payment of the registration charge for new registrations.