Data Protection (Registration and Charges) (Jersey) Regulations 2018

Summary

These Regulations, made under the Data Protection Authority (Jersey) Law 2018, set out the registration process and annual charges payable by data controllers and processors registered with the Jersey Office of the Information Commissioner. They specify what particulars appear on the register, how charges are calculated based on staff numbers, revenue, financial services status and processing of special category data, and when charges and information must be provided.

• Registration particulars: The Authority may record whether an entry relates to a controller and/or processor, a registration number, the date of entry, contact information, and any other information it considers necessary.
• Notification of changes: Registered controllers and processors must notify the Authority of any change to particulars provided at application, as soon as practicable and within 28 days of the change.
• Annual charge: Every registered controller and processor must pay an annual charge for each calendar year (or part) of registration; the base amount ranges from 70 pounds to 500 pounds depending on full-time equivalent employee numbers, with additional amounts for high revenue, financial services registration, or processing of special category data.
• Reduced charge for administered entities: A controller or processor administered by a trust company business or fund services business pays a flat annual charge of 50 pounds instead of the standard calculation, but cannot also claim the exemption under Regulation 6(4).
• Information requirement: When paying the annual charge, a payer must supply sufficient information to identify itself and substantiate the correct charge amount, including employee numbers, past-year revenues, financial services registration status, special category data processing, and (where relevant) the administering trust or fund services business.
• Exemptions: Certain processing is exempt from the annual charge, including processing by public authorities, election candidates, provided schools, businesses solely retaining records after ceasing to trade, and qualifying non-profit associations, subject to conditions in the Schedule.
• Removal from register: The Authority may remove an entry from the register if the controller or processor fails to notify changes, fails to pay the charge, fails to provide required information, or provides false, misleading or incomplete information.

The Regulations also require the Authority itself to notify controllers and processors of any addition, amendment or removal of a register entry within 28 days.

Key obligations

• Registered controllers and processors must notify the Authority of any change to particulars provided in their registration application, as soon as practicable and in any event within 28 days of the change.
• Every registered controller and processor must pay an annual charge to the Authority for each calendar year, or part of a calendar year, in which it is registered, calculated per Regulations 6A and 6B.
• An annual charge falls due on 1 January of the relevant year and must be paid by the last day of the following month; if registration occurs during the year, the charge falls due one month after registration.
• When paying an annual charge, a payer must provide the Authority with sufficient information to identify itself and substantiate the correctness of the payment amount, including employee numbers, past-year revenues, financial services registration status, special category data processing, and (if applicable) the administering trust or fund services business.
• A payer must provide any additional information requested by the Authority relating to calculation of its annual charge.
• The Authority must notify a controller or processor within 28 days of making, amending or removing an entry relating to them in the register.

Applies to

registered controllers, registered processors, public authorities, trust company businesses, fund services businesses, non-profit associations, provided schools, businesses registered with the Jersey Financial Services Commission

Deadlines

• within 28 days of the change: Registered controllers and processors must notify the Authority of changes to their registration particulars.
• within 28 days of making, amending or removing an entry: The Authority must notify the affected controller or processor of the register change.
• due 1 January of the relevant year, payable by the last day of the following month: Annual charge payment deadline for registered controllers and processors.
• one month after registration: Annual charge due date if a controller or processor becomes registered during the course of a year.

Related documents

• This document is made under Data Protection Authority (Jersey) Law 2018