Transferring Personal Data Outside Jersey

Summary

This is JOIC guidance explaining the rules in Part 8 of the Data Protection (Jersey) Law 2018 (DPJL 2018) that apply when personal data is sent, or made accessible, from Jersey to a person or organisation outside Jersey (a Restricted Transfer). It covers when the rules apply, the lawful bases for making such a transfer, and practical tools (a Transfer Impact Assessment checklist and template, and the Bailiwick of Jersey Addendum for use with Standard Contractual Clauses).

• When rules apply: Whenever personal data is sent to, or made accessible by, a legally separate Receiver located outside Jersey and the EEA (a Third Country), regardless of the volume or frequency of transfer; transfers to employees of the same entity or genuine data in transit are excluded.
• Lawful transfer routes: A Restricted Transfer is permitted if the Third Country has an EU adequacy decision, if appropriate safeguards are in place (such as Standard Contractual Clauses plus the Jersey Addendum, or Binding Corporate Rules), or if a specific Schedule 3 exception applies (e.g. explicit consent, contractual necessity, one off situations).
• Necessity and minimisation: Controllers/processors must consider alternatives before transferring data abroad, such as anonymisation, data minimisation, or using a Jersey based supplier, and document that reasoning.
• Risk assessment: Where the destination country lacks adequacy, a Transfer Impact Assessment should be carried out and recorded, weighing risks, safeguards and the conclusion reached.
• Transparency: Individuals must be told where their personal data is being sent or processed, in line with Article 12 transparency obligations.
• Residual exception (Schedule 8, paragraph 9): This last-resort exception may only be used where no other mechanism applies, the transfer is occasional (not systematic), involves a limited number of data subjects, and is necessary for compelling legitimate interests that outweigh individuals' rights; JOIC must be informed of the transfer as soon as practicable and may object or issue orders preventing it, and affected data subjects must also be told. Public authorities cannot rely on this exception when exercising public powers.

The guidance is explanatory rather than a standalone instrument, but it restates binding obligations under the DPJL 2018 that controllers and processors making international transfers must follow, including documentation, assessment and notification duties tied to specific transfer mechanisms.

Key obligations

• Only make a Restricted Transfer where the receiving country has an adequacy decision, appropriate safeguards (e.g. SCCs plus the Bailiwick of Jersey Addendum, or Binding Corporate Rules) are in place, or a Schedule 3 exception applies
• Assess and document whether transferring personal data outside Jersey is necessary, considering anonymisation, data minimisation, or use of a Jersey based supplier as alternatives
• Carry out and record a Transfer Impact Assessment before transferring personal data to a Third Country without an adequacy decision
• Inform individuals (data subjects) about where their personal data is being sent or processed, per Article 12 transparency requirements
• When relying on the Schedule 8 paragraph 9 residual exception, inform the JOIC of the transfer as soon as practicable, provide full details of the necessity and balancing assessment carried out, and inform the affected data subjects of the transfer and the reasoning
• Ensure onward transfers (e.g. from an EEA recipient to a further Third Country recipient, or to sub-processors outside Jersey) also comply with the transfer rules, as the original Sender remains responsible

Applies to

controllers, processors, data controllers/processors located in Jersey, sole traders, trust companies, financial services companies, law firms, businesses transferring personal data outside Jersey