Registration

Summary

This is JOIC guidance explaining the statutory registration and charging regime under the Data Protection (Jersey) Law 2018 and the Data Protection (Registration and Charges) (Jersey) Regulations 2018. It sets out who must register as a data controller or processor, how registration and renewal work, and how the annual registration charge is calculated.

• Who must register: All data controllers and processors established in Jersey that process personal data must register with the Authority, unless an exemption applies (e.g. purely personal/domestic processing, non-personal data, or national security processing). Processing without registration is a criminal offence.
• Registration and renewal cycle: Registrations expire on 31 December each year; the renewal window opens 1 January and renewal must be completed by the last day of February, or the registration will expire.
• Keeping details current: Controllers and processors must notify JOIC of any change to registration details, or deregister when registration is no longer required, within 28 days of the change; failure to keep the entry up to date is a criminal offence.
• Registration charges: Registered organisations must pay an annual registration charge (unless exempt, e.g. public authorities, election candidates, provided schools, dormant/ceased businesses, non-profits), calculated from full-time equivalent employees, prior-year revenue, JFSC/Proceeds of Crime Law status, and whether special category data is processed. Charges for renewals are due by the last day of February; for new registrations, one month after submission.
• Non-payment consequences: Failure to pay a required charge can result in removal from the Register, after which the organisation may not lawfully continue processing personal data.
• Administered entities: Trust company businesses and fund services businesses administering other entities may register those entities as administered, attracting an additional charge per administered entity, unless the administered entity is already separately registered.

The guidance also defines key terms (controller, processor, DPO, Data Protection Lead, special category data, public authority, FTE calculation methodology, and JFSC-regulated activities) relevant to determining registration and charge obligations.

Key obligations

• Controllers and processors established in Jersey that process personal data must register with the JOIC before processing personal data, except where an exemption applies.
• Registered controllers and processors must renew their registration annually; renewal must be completed by the last day of February each year or the registration expires.
• Controllers and processors must notify JOIC of any changes to registration details (including correspondence email, organisation details, DPO/lead details) within 28 days of the change.
• If registration is no longer required, the organisation must inform JOIC and deregister as soon as possible and at the latest within 28 days of the change (subject to record-retention exceptions).
• Registered controllers and processors, unless exempt, must pay the annual registration charge; for renewals the charge is due by the last day of February and for new registrations one month after submission.
• When responsibility for managing a registration transfers to a new person, the registration number and security code must be shared and registration details updated within 28 days of the change.

Applies to

data controllers, data processors, public authorities, candidates for election, provided schools, non-profit organisations, trust company businesses, fund services businesses, organisations registered with the Jersey Financial Services Commission

Deadlines

• 31 December each year: Registrations expire on this date each year.
• 1 January: Renewal window opens.
• last day of February: Deadline to complete registration renewal and to pay the renewal registration charge.
• 28 days: Deadline to notify JOIC of changes to registration details, to deregister, or to update details after a change in the person responsible for managing the registration.
• one month after the registration is submitted: Deadline to pay the registration charge for new registrations.