GG-ALD Data Protection & Privacy Regulation

GG-ALD schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: Sentinel (AML/CFT), World Payments, Advennt, artificial-intelligence

Last updated 2026-11-04 · 10 categories · 22 claims · 32 sources in the cumulative register

Data collected 2026-11-01Data published 2026-11-04

AI-assembled from cited sources

Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.

Evidence re-verified: 2026-11-04·Position last changed: 2026-11-04·

Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build Report Compare

Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authorityOffice of the Data Protection Authority (ODPA)Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record

Module coverage & confidence10 / 10 modules assessed0 Confirmed · 9 Probable · 1 Uncertain

Jurisdiction lead brief

Latest update · 4 November 2026

Lead Signal

The Office of the Data Protection Authority has confirmed that annual registration fees under the Data Protection (Bailiwick of Guernsey) Law, 2017 will rise by more than 4%, applying Bailiwick-wide and therefore reaching registered controllers in Alderney, with the increase taking effect from 1 January 2027. The fee schedule change was announced on 20 October 2026 and has not yet come into effect, so the current fee level continues to apply until the new year.

Other Developments

No further Alderney-specific development in the regulator-and-framework space has surfaced beyond the fee announcement this period. The underlying registration regime itself, under which Alderney organisations have been required to register with the Authority since 1 January 2021, remains unchanged in its basic structure; what has changed is the price of participating in it.

Cross-Monitor Connections

None identified this period for this module.

Outlook

The fee rise is a routine adjustment to the funding model of a regulator that describes itself as funded entirely by registration income, rather than a sign of any substantive change to obligations. Registered controllers Bailiwick-wide, including those based in Alderney, should expect the higher fee from the start of 2027; whether any Alderney-specific fee band is set within that schedule, as distinct from the general Bailiwick rate, has not yet been confirmed and is worth watching when the new schedule is published in full.

1 earlier update not shown here.

Standing brief · as of 4 October 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

The Office of the Data Protection Authority has partially upheld a complaint against the States of Alderney, finding that the former Chief Executive's subject-access request was answered with inconsistent and excessive redactions, in breach of section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017. The decision, published on 26 November 2025, is the most recent Alderney-specific enforcement and redress event on record and demonstrates that Bailiwick-wide data-protection enforcement reaches Alderney's own public-sector controllers directly, confirming that the territorial test under the Law operates in practice and not only on paper.

Other Developments

Subject-access rights in the public sector. The underlying finding concerned a controller's handling of a subject-access request: the States of Alderney, acting as controller, was found to have applied redactions to a letter provided in response to the request in a manner the ODPA assessed as inconsistent and excessive, amounting to a breach of the right of access under section 15 of the Law. This is the governing development for the data-subject-rights module this period and the first GG-ALD-specific access-rights finding of its kind identified in this evidence set.

Cross-Monitor Connections

No factual basis is present in this cycle's structured input to route this development to financial-integrity, world-payments, advennt, artificial-intelligence, or crypto; the finding concerns a public-sector subject-access complaint with no evidenced nexus to those domains this cycle.

Outlook

The ODPA's decision against the States of Alderney stands as a confirmed instance of enforcement reaching an Alderney public-sector controller under the Bailiwick-wide statute. Whether further corrective or remedial steps follow from the States of Alderney, or whether this finding prompts wider public-sector guidance on redaction practice in responding to subject-access requests, is not addressed in the evidence available this cycle.

Key regulatory facts for GG-ALD
Regulatory Dimension	GG-ALD Standing Position
Jurisdiction	GG-ALD (GG-ALD)
Regulatory Scope	Data Protection & Privacy Regulation (10 modules, 22 sourced findings)
Regulator & Framework	A comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement...
Lawful Processing & Special Data	Core lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available...
Data Subject Rights	Core rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates.
Controller/Processor Duties	Breach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap.
Primary Instruments Cited	Bailiwick Express, Bailiwick Express, GG-ALD Official Instrument (odpa.gg www-odpa-gg), ODPA - The Law, GG-ALD Official Instrument (dlapiperdataprotection.com index-html-t-law-c-GG)
Last Confirmed / Updated	2026-11-04 (32 sources in cumulative register)

#

A comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement date of the Alderney 2009 Ordinance).

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — GreenA comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement date of the Alderney 2009 Ordinance).

Sub-modules (5)

Regulator And AuthorityGreen

ODPA is confirmed as the independent supervisory authority for the Bailiwick, including Alderney.

Claims (3):

Office of the Data Protection Authority — The ODPA is the independent supervisory authority for the Data Protection (Bailiwick of Guernsey) Law, 2017, covering Guernsey, Alderney and Sark.
Office of the Data Protection Authority (ODPA) — The Bailiwick of Guernsey's data protection regulator, delegated day-to-day regulatory functions by the Data Protection Authority under the Data Protection (Bailiwick of Guernsey) Law, 2017.
ODPA is the independent supervisory authority under the Data Protection (Bailiwick of Guernsey) Law, 2017.

Act And InstrumentsGreen

Primary instrument is the 2017 Law (in force 25 May 2018), object clause equivalent to GDPR/LED; amended/associated by several ordinances and regulations including an Alderney-specific ePrivacy ordinance.

Claims (2):

Data Protection (Bailiwick of Guernsey) Law, 2017 — Came into force on 25 May 2018, replacing the 2001 Law and implementing GDPR/LED equivalence across the Bailiwick, including Alderney.
ODPA announced that annual registration fees (Bailiwick-wide, including Alderney) will rise by more than 4% from 1 January 2027.

Material ScopeAmber

Section 2 'Condition A' confirms automated-means processing is caught; the full text of 'Condition B' (manual filing systems) was not captured in retrieved sources.

Claims (1):

Data Protection (Bailiwick of Guernsey) Law, 2017, s.39 — Section 39 prohibits all controllers and processors established in the Bailiwick from processing personal data unless registered with the ODPA; failure to comply is a criminal offence.

Territorial ScopeRed

No pinpoint provision equivalent to GDPR Art 3(2) targeting/monitoring test, household exclusion, or Art 27-equivalent representative duty was located for the Bailiwick Law within available sources.

Claims (2):

Data-protection registration and fee obligations were extended to require Alderney organisations to register with the ODPA from 1 January 2021.
Data Protection (Bailiwick of Guernsey) Law, 2017, s.111 — An entity is 'established in the Bailiwick', and thus caught by the Law, if it is a Guernsey/Alderney/Sark person, maintains an office/branch/agency or regular practice there, causes processing equipment there to be used other than for transit, or engages in effective and real processing through stable arrangements there.

Regulator Registration And FilingGreen

Annual registration and levy regime in force since 2021 for controllers/processors established in the Bailiwick, with tiered fees and exemptions for charities.

Claims (5):

The ODPA found the States of Alderney, as controller, breached section 15 of the DPL 2017 (right of access) through inconsistent and excessive redactions of a letter provided to a former Chief Executive in response to a subject-access request.
Data Protection (Bailiwick of Guernsey) Law, 2017 — The Law differentiates 'authorised jurisdictions' (including EU member states and EC-adequacy countries) from 'unauthorised jurisdictions' for cross-border transfer purposes, applicable Bailiwick-wide including Alderney.
ODPA announced that annual registration fees (Bailiwick-wide, including Alderney) will rise by more than 4% from 1 January 2027.
Office of the Data Protection Authority (ODPA) — GBP 62.22 (under 50 employees) or GBP 2,488.80 (50+ employees), a 3.7% RPI-linked increase, effective 1 January 2026; charities/not-for-profits register but pay no fee.
Data Protection (Bailiwick of Guernsey) Law, 2017, s.39 — Section 39 prohibits all controllers and processors established in the Bailiwick from processing personal data unless registered with the ODPA; failure to comply is a criminal offence.

Category narrative 147 words

Alderney (as part of the Bailiwick of Guernsey) is governed by the Data Protection (Bailiwick of Guernsey) Law, 2017, a single omnibus statute applied across Guernsey, Alderney and Sark. The Office of the Data Protection Authority (ODPA) is the independent supervisory authority. The Law's stated object is to protect individuals' rights and provide for free movement of personal data 'in a manner equivalent to the GDPR and the Law Enforcement Directive'. Alderney also has its own historical ePrivacy transposition (the Alderney Ordinance No. VIII of 2009) listed among the instruments amending/associated with the consolidated Law. Controllers/processors established in the Bailiwick (including Alderney) must register annually with ODPA and pay a levy on a tiered scale. The precise extraterritorial/establishment test equivalent to GDPR Art 3(2) could not be confirmed from the retrieved consolidated text (truncated at the automated-means limb of the 'Condition A/B' application test in section 2).

Periodic update · new data 2026-11-04

Regulator & Framework

The Office of the Data Protection Authority is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017, a position it has held since the Law came into force on 25 May 2018. Alderney organisations have been brought within the same registration framework as the rest of the Bailiwick, required to register with the Authority from 1 January 2021.

The Authority has announced that annual registration fees will rise by more than 4% from 1 January 2027, a change that applies Bailiwick-wide and therefore to registered controllers based in Alderney. The announcement was made on 20 October 2026; the increase itself has not yet come into effect and will not apply until the new year. The Authority states that it is funded entirely by registration fees and operates independently of the States of Guernsey, which situates the fee rise as a funding-model adjustment internal to the regulator's own financing rather than a change to the substance of what registered controllers must do.

Whether a separate fee band applies specifically to Alderney-registered organisations, distinct from the general Bailiwick-wide schedule, has not been confirmed and will depend on the detail of the published 2027 fee schedule.

Outlook

Controllers registered in Alderney should plan for the higher registration cost from the start of 2027 while the obligation to register itself remains unchanged. The open question is whether the new schedule treats Alderney organisations identically to the rest of the Bailiwick or introduces any differentiated band; that will only be settled once the Authority publishes the full 2027 fee table.

Sources and claims (9)

Probable Bailiwick Express — ODPA announced that annual registration fees (Bailiwick-wide, including Alderney) will rise by more than 4% from 1 January 2027. observed 2026-11-01
Probable Bailiwick Express — Office of the Data Protection Authority (ODPA) — GBP 62.22 (under 50 employees) or GBP 2,488.80 (50+ employees), a 3.7% RPI-linked increase, effective 1 January 2026; charities/not-for-profits register but pay no fee. observed 2026-10-25
Confirmed https://www.odpa.gg/ — Office of the Data Protection Authority — The ODPA is the independent supervisory authority for the Data Protection (Bailiwick of Guernsey) Law, 2017, covering Guernsey, Alderney and Sark.
Confirmed ODPA - The Law — Data Protection (Bailiwick of Guernsey) Law, 2017 — Came into force on 25 May 2018, replacing the 2001 Law and implementing GDPR/LED equivalence across the Bailiwick, including Alderney. observed 2026-10-04
Probable https://www.dlapiperdataprotection.com/index.html?t=law&c=GG — Data Protection (Bailiwick of Guernsey) Law, 2017, s.39 — Section 39 prohibits all controllers and processors established in the Bailiwick from processing personal data unless registered with the ODPA; failure to comply is a criminal offence.
Probable https://www.dlapiperdataprotection.com/index.html?t=authority&c=GG — Office of the Data Protection Authority (ODPA) — The Bailiwick of Guernsey's data protection regulator, delegated day-to-day regulatory functions by the Data Protection Authority under the Data Protection (Bailiwick of Guernsey) Law, 2017.
Confirmed https://www.odpa.gg/ — ODPA is the independent supervisory authority under the Data Protection (Bailiwick of Guernsey) Law, 2017.
Probable Bailiwick Express — Data-protection registration and fee obligations were extended to require Alderney organisations to register with the ODPA from 1 January 2021. observed 2026-11-01
Confirmed ODPA guidance - 'Established in the Bailiwick' — Data Protection (Bailiwick of Guernsey) Law, 2017, s.111 — An entity is 'established in the Bailiwick', and thus caught by the Law, if it is a Guernsey/Alderney/Sark person, maintains an office/branch/agency or regular practice there, causes processing equipment there to be used other than for transit, or engages in effective and real processing through stable arrangements there. observed 2026-10-04

#

Core lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available sources in this pass.

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Schedule 2

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — AmberCore lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available sources in this pass.

D2 · Lawful Processing — Full Module Record4 sub-modules · 123 words · 4 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Core rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates.

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Part III

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — GreenCore rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates.

Sub-modules (5)

Access RightGreen

Right of access sits alongside the information and portability rights in Part III; ODPA issued DSAR process guidance in 2023.

Claims indexed in baseline register · source extraction in progress

Rectification And ErasureAmber

No pinpoint erasure-grounds provision was retrieved distinct from the general Part III rights architecture.

Claims (1):

Alderney data subjects hold statutory rights to rectification, erasure in certain circumstances, and restriction of processing under the Bailiwick of Guernsey Law.

Restriction And ObjectionGreen

Sections 17-19 give an absolute objection right for direct marketing and a conditional cessation right where processing rests on public-task/legitimate-interests or historical/scientific-purpose conditions.

Claims indexed in baseline register · source extraction in progress

Data PortabilityAmber

Portability right is listed in the Part III arrangement of sections alongside access; detailed scope/exceptions text not retrieved.

Deadlines And Response WindowsGreen

The 'designated period' for indirect-collection information duties and other Part III requests is one month from the relevant day, extendable with notice.

Claims indexed in baseline register · source extraction in progress

Category narrative 83 words

Part III of the Law confers rights modelled on GDPR Arts 13-22, including rights to information (direct and indirect collection), access, portability, objection (direct marketing is an absolute right; public-task/legitimate-interests processing carries a qualified cessation right), and protection against solely automated decision-making (section 24), the latter surviving even the Schedule 8 trusts exemption. The statutory response window ('the designated period') is one month, extendable with notice to the requester. ODPA has issued non-binding DSAR-handling guidance (June 2023). No Guernsey-specific minors'-capacity-to-exercise-rights-alone provision was located.

No periodic updates recorded in this cycle

Sources and claims (1)

Confirmed States of Alderney - Data Protection — Alderney data subjects hold statutory rights to rectification, erasure in certain circumstances, and restriction of processing under the Bailiwick of Guernsey Law. observed 2026-11-01

#

Breach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap.

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Part IV

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — AmberBreach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap.

D4 · Controller & Processor — Full Module Record7 sub-modules · 138 words · 2 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Both EU-side and UK-side adequacy status for the Bailiwick (covering Alderney) are confirmed as currently in force via primary/official sources; secondary transfer-mechanism detail (SCC uptake, localisation, TIA test) is a gap.

Primary frameworkCommission Decision 2003/821/EC (EU adequacy); UK Data Protection Act 2018 adequacy regulations

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — GreenBoth EU-side and UK-side adequacy status for the Bailiwick (covering Alderney) are confirmed as currently in force via primary/official sources; secondary transfer-mechanism detail (SCC uptake, localisation, TIA test) is a gap.

D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 132 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

One strong Alderney-specific instrument (the 2009 ePrivacy Ordinance) is confirmed; most other sectoral sub-modules carry no confirmed Bailiwick-specific overlay and are recorded as explicit gaps.

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — AmberOne strong Alderney-specific instrument (the 2009 ePrivacy Ordinance) is confirmed; most other sectoral sub-modules carry no confirmed Bailiwick-specific overlay and are recorded as explicit gaps.

D6 · Sectoral Watch — Full Module Record8 sub-modules · 143 words · 8 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

A concrete Alderney-specific enforcement/outreach action on dark patterns in gambling is confirmed, but the underlying statutory cookie-consent and dark-pattern-prohibition pinpoints were not retrieved.

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017 (general); Alderney Ordinance No. VIII of 2009 (ePrivacy, for electronic communications context)

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — AmberA concrete Alderney-specific enforcement/outreach action on dark patterns in gambling is confirmed, but the underlying statutory cookie-consent and dark-pattern-prohibition pinpoints were not retrieved.

D7 · AdTech & Marketing — Full Module Record6 sub-modules · 105 words · 6 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

The core ADM-protection right and ODPA's AI guidance are confirmed; biometric-specific rules and any AI Act interface analysis remain unconfirmed gaps.

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, section 24

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — AmberThe core ADM-protection right and ODPA's AI guidance are confirmed; biometric-specific rules and any AI Act interface analysis remain unconfirmed gaps.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 100 words · 2 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

No children-and-vulnerable-groups-specific statutory pinpoint was retrievable for the Bailiwick despite multiple targeted search passes; this module is reported as an explicit, flagged gap rather than silently omitted.

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — RedNo children-and-vulnerable-groups-specific statutory pinpoint was retrievable for the Bailiwick despite multiple targeted search passes; this module is reported as an explicit, flagged gap rather than silently omitted.

D9 · Children's Privacy — Full Module Record5 sub-modules · 68 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Enforcement cooperation activity and an appeal route are confirmed; the core penalty/fine-amount and collective-redress mechanics -- central to this module -- remain unconfirmed gaps requiring primary-source escalation.

Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017

Supervisory authorityOffice of the Data Protection Authority (ODPA)

Traffic-light rationale — AmberEnforcement cooperation activity and an appeal route are confirmed; the core penalty/fine-amount and collective-redress mechanics -- central to this module -- remain unconfirmed gaps requiring primary-source escalation.

Periodic update · new data 2026-10-25

Enforcement & Redress

Two developments touch enforcement and redress in this period, one concerning a reprimand and the other concerning the Authority's international standing. The Channel Islands Financial Ombudsman is reported to have received a second data-protection reprimand, this one following a complaint about a response to a Subject Access Request that was described as lacking clarity. Reports indicate a first reprimand was issued in 2020 by the Guernsey Authority, after an email containing special-category data was sent to the wrong recipient. Both reprimands concern the Ombudsman's own handling of personal data rather than its function as a dispute-resolution body for financial services complaints across the Bailiwick, including Alderney. This history, if accurate, suggests a recurring vulnerability in the Ombudsman's data-handling practices across two separate incident types, misdirected special-category data in the earlier case and inadequate clarity in responding to a Subject Access Request in the more recent one.

These reports rest on a secondary summary rather than the Authority's own primary enforcement register, and the detail available this period, including the precise date and reasoning of the more recent reprimand, has not been corroborated against that primary source. Readers should treat the account of the second reprimand as reported rather than as confirmed pending that corroboration.

Separately, the Authority's own institutional standing was reinforced through its reported election to the Executive Committee of the Global Privacy Assembly, announced 11 May 2026, attributed to its role as co-chair or secretariat of the Global Privacy Assembly's International Enforcement Cooperation Working Group. While this is an institutional and international-cooperation development rather than a domestic enforcement action, it bears on the Authority's own capacity and standing as an enforcement body, including its participation in cross-border enforcement cooperation mechanisms that could, in principle, support future redress efforts for data subjects in the Bailiwick.

No other enforcement action, decision, or redress development specific to Alderney was identified this period.

Outlook

Corroboration of the Channel Islands Financial Ombudsman reprimand against the Authority's own primary enforcement register would sharpen confidence in the account reported here. The Authority's continued participation in the Global Privacy Assembly's Executive Committee and International Enforcement Cooperation Working Group may support further cross-border enforcement cooperation activity, though no specific future action has been identified at this time.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 148 words · 5 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 22 claim(s) (22 category placement(s)), 32 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	deadlines and response windows
`Art. 14`	Data Subject Rights	deadlines and response windows
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	restriction and objection
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy granted
`Art. 46`	Cross-Border & Adequacy	sccs and bcrs
`Art. 47`	Cross-Border & Adequacy	sccs and bcrs
`Art. 48`	Cross-Border & Adequacy	transfer mechanisms
`Art. 49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77`	Enforcement & Redress	private right of action
`Art. 78`	Enforcement & Redress	regulator powers and penalties
`Art. 79`	Enforcement & Redress	regulator powers and penalties
`Art. 80`	Enforcement & Redress	regulator powers and penalties
`Art. 81`	Enforcement & Redress	regulator powers and penalties
`Art. 82`	Enforcement & Redress	regulator powers and penalties
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	collective redress and class actions

GG-ALD Data Protection & Privacy Regulation

Jurisdiction lead brief

Latest update · 4 November 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 4 October 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

GG-ALD: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾#

Sub-modules (5)

Regulator And AuthorityGreen

Act And InstrumentsGreen

Material ScopeAmber

Territorial ScopeRed

Regulator Registration And FilingGreen

Regulator & Framework

Outlook

GG-ALD: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

GG-ALD: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾#

Sub-modules (5)

Access RightGreen

Rectification And ErasureAmber

Restriction And ObjectionGreen

Data PortabilityAmber

Deadlines And Response WindowsGreen

GG-ALD: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

GG-ALD: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾#

GG-ALD: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

GG-ALD: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

GG-ALD: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

GG-ALD: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾#

GG-ALD: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Enforcement & Redress

Outlook

Provenance and declared absence

GDPR article map

#

#

#

#

#

#

#

#

#

#