Jersey. Comprehensive data protection. Act
DPJLData Protection (Jersey) Law 2018
In force
§1Summary
- Synopsis
Jersey's GDPR-equivalent law setting principles, lawful processing conditions, data subject rights, controller and processor duties and transfer rules. It works with the Data Protection Authority (Jersey) Law 2018, which creates the regulator and its fining powers.
- Key themes
- Unique features
Controllers and processors must register with the Authority and pay an annual charge; fines are set in the companion Authority Law.
- SaaS relevance
Applies to SaaS providers established in Jersey and to those outside Jersey processing data of people in Jersey in the context of offering goods/services or monitoring.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Information Commissioner within 72h; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy (incl. EU/EEA, UK)/standard clauses/BCRs
- Maximum penalty
- See DPAJL: up to £10m (or 10% global turnover in some cases)
§3Dates
- Key dates
- Adopted
- In force
- Replaced Data Protection (Jersey) Law 2005; consolidated version current from 2026-10-02
§4Text and authority
- Text
- Authoritative text jerseylaw.je
- Authority
- Jersey Data Protection Authority / Jersey Office of the Information Commissioner (JOIC)
§5Where it applies
- Domestic law of
- Jersey
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EU adequacy Decision 2008/393/EC; confirmed in the Commission's January 2024 review of 11 pre-GDPR decisions.