DPL 2017Data Protection (Bailiwick of Guernsey) Law, 2017Guernsey's GDPR-equivalent data protection law covering Guernsey, Alderney and Sark. It sets GDPR-style principles, rights, accountability duties and fines enforced by the ODPA.
- Synopsis
Guernsey's GDPR-equivalent data protection law covering Guernsey, Alderney and Sark. It sets GDPR-style principles, rights, accountability duties and fines enforced by the ODPA.
- Key themes
- Unique features
Fines tiered at £5m and £10m, with a £300,000 cap for some and 10% of global turnover for others; directors and officers can be personally liable; annual registration with the ODPA.
- SaaS relevance
Applies to Guernsey-established SaaS providers and to non-Guernsey controllers/processors targeting or monitoring people in the Bailiwick.
- Extraterritorial
- Yes
- Breach notification
- ODPA within 72h; individuals as soon as practicable if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy/standard clauses/BCRs
- Maximum penalty
- Up to £10m; turnover-based cap up to 10% of global turnover in some cases
- Key dates
- Adopted
- In force
- Replaced Data Protection (Bailiwick of Guernsey) Law 2001
- Text
- Authoritative text guernseylegalresources.gg
- Authority
- Data Protection Authority / Office of the Data Protection Authority (ODPA)
- Sources consulted
- Verification
High confidence.
EU adequacy Decision 2003/821/EC, confirmed in the 2024 Commission review.
- Record
- Full record for DPL 2017