data protection

Who is caught

Jersey's data protection regime rests on two 2018 statutes. The Data Protection (Jersey) Law 2018 sets the substantive obligations, principles, data subject rights and transfer rules, while the Data Protection Authority (Jersey) Law 2018 establishes the Data Protection Authority and Information Commissioner and provides the registration, charging and enforcement machinery used to apply it.

• Controllers and processors: The core duties fall on data controllers (who determine purposes and means of processing) and processors (who process on a controller's behalf), including joint controllers where purposes and means are decided jointly.
• Data protection officers: The Law requires a DPO to be appointed in prescribed circumstances, with a defined independent position and duties.
• Public and scheduled public authorities: The instruments apply to public authorities, scheduled public authorities, credit reference agencies and health professionals, among others.
• Territorial reach: Guidance on the Law's scope states it applies to controllers and processors established in Jersey, those using equipment in Jersey, and those outside Jersey who process Jersey data subjects' data to offer goods or services or monitor behaviour.

The Law reaches automated processing and manual records held in a structured filing system, but not purely personal or household activity. JOIC guidance applies these obligations to specific activities, including CCTV and other surveillance systems, and the use of AI systems that process personal data; separate JFSC guidance explains how regulated financial services firms should apply existing data protection, AML and cybersecurity obligations when deploying AI.

Sources: Guidance on the use of AI in Jersey's financial services sector · Data Protection (Jersey) Law 2018 · Data Protection Authority (Jersey) Law 2018 · What to think about before using Artificial Intelligence · Your Duties and Responsibilities as a Data Controller · Definitions, the Data Protection Principles and Lawful Bases · Registration · CCTV and Surveillance at Work and at Home

Key duties

The recurring, deadline-bearing duties are registration and payment of annual charges, breach notification, and the handling of data subject requests. These sit alongside continuing accountability, security and governance obligations.

Registration and charges

• Register before processing: Controllers and processors established in Jersey must register with the Authority under Article 17 of the Data Protection Authority (Jersey) Law 2018 before processing personal data; guidance states newly formed entities must register at or before incorporation, and processing without registration is a criminal offence.
• Annual charge: Under the Data Protection (Registration and Charges) (Jersey) Regulations 2018, every registered controller and processor must pay an annual charge for each calendar year of registration, calculated by reference to full-time equivalent employee numbers, revenue, financial services registration status and processing of special category data, with a base amount starting at £70.
• Administered entities: An entity administered by a trust company business or fund services business may qualify for a flat £50 annual charge instead of the standard calculation.
• Payment timing: The charge falls due on 1 January and must be paid by the last day of the following month; where registration occurs during the year it falls due one month after registration. Guidance describes an annual renewal window running from 1 January to the last day of February.
• Notify changes: Registered controllers and processors must notify the Authority of any change to their registration particulars as soon as practicable and within 28 days of the change.

Breach notification

• Notify the Authority: Controllers must notify JOIC of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of a breach that could risk individuals' rights and freedoms, phasing information where full details are not yet available.
• Notify individuals: Where a breach poses a high risk of harm, controllers must inform affected individuals without undue delay, unless proportionate protective measures remove the high risk.
• Breach log: Controllers must keep a detailed log of all breaches, reportable or not, which JOIC may inspect during audits. A processor that suffers a breach must notify the controller without undue delay, and the controller remains responsible for notifying JOIC.

Accountability and governance

• Principles and lawful basis: Controllers must process in accordance with the six data protection principles in Article 8, identify a lawful basis under Schedule 2 Part 1 (and a specific condition under Part 2 for special category data) before processing begins, and demonstrate accountability.
• By design and default: Controllers must implement data protection by design and by default under Article 15, ensuring only necessary data is processed by default.
• DPIAs and prior consultation: A DPIA is required before processing likely to result in high risk; where a DPIA shows a high risk that cannot be mitigated, the controller must consult the Authority in writing under Article 17 before processing starts. On a consultation submission, JOIC must give its opinion within eight weeks, extendable by a further six weeks in complex cases.
• Records and security: Controllers and processors must keep records of processing activities where applicable and implement appropriate technical and organisational security measures under Article 21, with processors acting only on documented instructions under a written contract.
• DPO: Where a DPO is required, the controller must support the DPO's independence, resources and access, publish contact details and provide them to JOIC.

Data subject rights and transfers

• Respond to requests: Controllers must handle access, rectification, erasure, restriction, portability and objection requests under the prescribed procedures; guidance states controllers must generally respond to subject access requests within four weeks, extendable for complex requests with notice given before the deadline.
• Cross-border transfers: Transfers of personal data outside Jersey are only permitted where the destination has an adequacy decision, appropriate safeguards (such as Standard Contractual Clauses with the Bailiwick of Jersey Addendum, or Binding Corporate Rules) are in place, or a Schedule 3 exception applies, with a Transfer Impact Assessment recorded where there is no adequacy decision.

Sources: Data Protection (Jersey) Law 2018 · Data Protection Authority (Jersey) Law 2018 · Data Protection (Registration and Charges) (Jersey) Regulations 2018 · Data Breaches - What they are and how to deal with them · Your Duties and Responsibilities as a Data Controller · Data Protection by Design and Default, and Data Protection Impact Assessments · Individual Rights – what they are, how to exercise them and how to manage them · Transferring Personal Data Outside Jersey · Registration · Administered Registrations

Exemptions and carve-outs

The instruments provide exemptions from substantive obligations, carve-outs from registration charges, and some out-of-scope cases.

Out of scope

• Personal or household activity: The Law does not apply to purely personal or household processing.
• Home CCTV within boundary: Guidance states the Law applies to home CCTV only where a camera captures images beyond the user's own property boundary.

Substantive exemptions (Part 7, Arts 41-62)

• Listed grounds: Part 7 provides exemptions and modifications from certain principles and subject rights for areas including national security (evidenced by a ministerial certificate), crime and taxation, corporate finance, trusts, legal privilege, confidential references, exam scripts, and journalistic, academic, literary and artistic material.
• Case-by-case only: Guidance stresses that exemptions are not blanket: controllers must assess each case individually, apply the minimum departure necessary, document the decision and remain able to justify reliance, and must still comply with all parts of the Law not covered by the exemption.
• Transfer exceptions: Transfers outside Jersey may rely on specific exceptions listed in Schedule 3 (for example explicit consent, contractual necessity, or one-off situations), with a last-resort residual exception subject to strict conditions and notification to JOIC.

Registration charge exemptions

• Exempt processing: The Registration and Charges Regulations exempt certain processing from the annual charge, including processing by public authorities, election candidates, provided schools, businesses solely retaining records after ceasing to trade, and qualifying non-profit associations, subject to Schedule conditions.
• No double benefit: An administered controller or processor paying the flat £50 charge cannot also claim the Regulation 6(4) exemption.
• Transitional registration: Under Schedule 2 of the Data Protection Authority (Jersey) Law 2018, controllers already registered under the 2005 Law, and all processors, were exempt from re-registering until the end of a defined registration period, with unregistered processors required to register within a 26 week transitional period.

Sources: Data Protection (Jersey) Law 2018 · Data Protection Authority (Jersey) Law 2018 · Data Protection (Registration and Charges) (Jersey) Regulations 2018 · Definitions, the Data Protection Principles and Lawful Bases · Exemptions - Arts.41-62 Data Protection (Jersey) Law 2018 · Transferring Personal Data Outside Jersey · Registration · CCTV and Surveillance at Work and at Home

Enforcement and penalties

Enforcement powers sit in the Data Protection Authority (Jersey) Law 2018, which gives the Authority investigation, inquiry and audit powers, sanctions and administrative fines. Orders and reprimands in concluded cases are made under Article 25(3) of that Law, and public statements are issued under Article 14.

Regulatory tools and sanctions

• Investigation powers: Authorized officers may issue information notices, enter and search premises subject to safeguards and warrant requirements, and conduct or require data protection audits, with the audited controller or processor bearing the cost of a required audit. A person served with an information notice must respond within 28 days (or a shorter period, generally not less than 7 days, in urgent cases).
• Orders, reprimands and warnings: The Authority may issue words of advice, formal reprimands, warnings, and orders requiring remedial action such as correcting or deleting data, stopping unlawful processing, notifying breaches, or responding properly to access requests.
• Administrative fines: The Authority may impose administrative fines. JOIC's enforcement policy describes statutory caps of up to £5,000,000, £10,000,000, or £300,000 or 10% of global turnover depending on the contravention, and £10,000 for not-for-profit public-interest processing. Guidance on breaches states that failing to notify JOIC when required can attract a fine of up to £5,000,000.
• Public statements: The Authority may publish a summary of its findings and orders, naming the controller or processor, where seriousness and public interest justify it.
• Public authorities: The Authority has repeatedly stated it is legally barred from imposing administrative fines on public authorities, issuing reprimands and orders instead.

Criminal offences and civil remedies

• Criminal offences: The Law and guidance identify criminal offences including failing to comply with an Authority order, unlawfully obtaining or sharing personal data, forced subject access requests, giving false information, and obstructing investigators, prosecutable in the Royal Court and punishable by fines and/or up to two years' imprisonment. Members and staff of the Authority commit an offence if they unlawfully disclose confidential information.
• Compensation: Individuals who suffer loss, damage or distress from non-compliant processing may seek compensation from the Royal Court; the Authority itself cannot award compensation.
• Non-payment of fines: Guidance notes that failure to pay an administrative fine can lead to civil debt recovery through the Petty Debts or Royal Court.
• Appeals: Controllers, processors and complainants may appeal Authority decisions to the Royal Court of Jersey within 28 days, on grounds that the decision was unreasonable, unfair in law or beyond the Authority's powers.

Published enforcement to date illustrates the range: administrative fines of £500 (JRSY Laser Limited) and £4,000 (Star-Delta Electrical Services) against private businesses, and reprimands with corrective orders against public bodies such as the JFSC, CYPES and several government departments where fines could not be imposed.

Sources: Data Protection (Jersey) Law 2018 · Data Protection Authority (Jersey) Law 2018 · Data Breaches - What they are and how to deal with them · What does Enforcement look like? Procedures, Powers and Penalties, Criminal and Civil · How We Deal with Complaints · Public Statement - Star Delta Electrical Services Fine (2025-03-25) · Public Statement - JRSY Laser Limited Fine (2025-03-18) · Public Statement - Children's Services (2021-10-21) · Regulatory Action and Enforcement Policy