Guernsey (Bailiwick of). Comprehensive data protection. Act
DPL 2017Data Protection (Bailiwick of Guernsey) Law, 2017
In force
§1Summary
- Synopsis
Guernsey's GDPR-equivalent data protection law covering Guernsey, Alderney and Sark. It sets GDPR-style principles, rights, accountability duties and fines enforced by the ODPA.
- Key themes
- Unique features
Fines tiered at £5m and £10m, with a £300,000 cap for some and 10% of global turnover for others; directors and officers can be personally liable; annual registration with the ODPA.
- SaaS relevance
Applies to Guernsey-established SaaS providers and to non-Guernsey controllers/processors targeting or monitoring people in the Bailiwick.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ODPA within 72h; individuals as soon as practicable if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy/standard clauses/BCRs
- Maximum penalty
- Up to £10m; turnover-based cap up to 10% of global turnover in some cases
§3Dates
- Key dates
- Adopted
- In force
- Replaced Data Protection (Bailiwick of Guernsey) Law 2001
§4Text and authority
- Text
- Authoritative text guernseylegalresources.gg
- Authority
- Data Protection Authority / Office of the Data Protection Authority (ODPA)
§5Where it applies
- Domestic law of
- Guernsey (Bailiwick of)
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EU adequacy Decision 2003/821/EC, confirmed in the 2024 Commission review.