Jersey JE

Comprehensive data protection2

• DPJLData Protection (Jersey) Law 2018In force
  In force from 25 May 2018Jersey's GDPR-equivalent law setting principles, lawful processing conditions, data subject rights, controller and processor duties and transfer rules. It works with the Data Protection Authority (Jersey) Law 2018, which creates the regulator and its fining powers.

  Synopsis

  Jersey's GDPR-equivalent law setting principles, lawful processing conditions, data subject rights, controller and processor duties and transfer rules. It works with the Data Protection Authority (Jersey) Law 2018, which creates the regulator and its fining powers.

  Key themes

  • principles
  • lawful processing
  • data subject rights
  • DPO
  • breach notification
  • transfers
  • registration

  Unique features

  Controllers and processors must register with the Authority and pay an annual charge; fines are set in the companion Authority Law.

  SaaS relevance

  Applies to SaaS providers established in Jersey and to those outside Jersey processing data of people in Jersey in the context of offering goods/services or monitoring.

  Extraterritorial

  Yes

  Breach notification

  Information Commissioner within 72h; individuals if high risk

  DPO

  Conditional

  Cross-border transfers

  Adequacy (incl. EU/EEA, UK)/standard clauses/BCRs

  Maximum penalty

  See DPAJL: up to £10m (or 10% global turnover in some cases)

  Key dates

  • Adopted 2018
  • In force 25 May 2018
  • Replaced Data Protection (Jersey) Law 2005; consolidated version current from 2026-10-02

  Text

  • Authoritative text jerseylaw.je

  Authority

  Jersey Data Protection Authority / Jersey Office of the Information Commissioner (JOIC)

  Sources consulted

  • jerseylaw.je

  Verification

  High confidence.

  EU adequacy Decision 2008/393/EC; confirmed in the Commission's January 2024 review of 11 pre-GDPR decisions.

  Record

  Full record for DPJL

• DPAJLData Protection Authority (Jersey) Law 2018In force
  In force from 25 May 2018Establishes the Jersey Data Protection Authority and the Information Commissioner, and gives the Authority powers to investigate, order corrective action and impose administrative fines. Day-to-day work is delegated to the Commissioner, while the Authority keeps fining and public statement powers.

  Synopsis

  Establishes the Jersey Data Protection Authority and the Information Commissioner, and gives the Authority powers to investigate, order corrective action and impose administrative fines. Day-to-day work is delegated to the Commissioner, while the Authority keeps fining and public statement powers.

  Key themes

  • regulator
  • enforcement
  • administrative fines
  • registration charges

  Unique features

  Tiered caps: £5m, £10m, and an alternative cap of £300,000 or 10% of global turnover; public-interest not-for-profit processors capped at £10,000.

  SaaS relevance

  Determines the penalty exposure of any SaaS provider within DPJL scope.

  Extraterritorial

  Yes

  Breach notification

  See DPJL

  Maximum penalty

  Up to £10m; alternative cap £300,000 or 10% of global turnover (higher)

  Key dates

  • Adopted 2018
  • In force 25 May 2018

  Text

  • Authoritative text jerseylaw.je

  Authority

  Jersey Data Protection Authority

  Verification

  Medium confidence.

  Partly verified

  Medium confidence. No verification notes recorded.

  Record

  Full record for DPAJL

  Partly verified

  Medium confidence. No verification notes recorded.