Not publishable as-is. 2 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
GG Data Protection & Privacy Regulation
GGschema gdpri-v2trajectory: not yet assessedregulated (omnibus)overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence
Last updated · 10 categories · 48
claims · 26 sources in the cumulative register
The Office of the Data Protection Authority (ODPA) co-signed, on 23 February 2026, a Joint Statement on AI-Generated Imagery and the Protection of Privacy together with sixty other data protection authorities worldwide, addressing non-consensual deepfake imagery with particular concern for children.
Data collected · Data published
AI-assembled from cited sources
Not covered: Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Lawful Processing & Special Data, Algorithmic, Biometric & Surveillance Governance (3 open gaps).
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
No red categories; 27 sub-modules are flagged red.
Jurisdiction lead brief
Standing brief, as of 25 October 2026.
Lead Signal
The Office of the Data Protection Authority (ODPA) co-signed, on 23 February 2026, a Joint Statement on AI-Generated Imagery and the Protection of Privacy together with sixty other data protection authorities worldwide, addressing non-consensual deepfake imagery with particular concern for children. This is a coordinated international supervisory position rather than a binding Guernsey statutory rule, but it places Guernsey's data-protection regulator in active international alignment on AI-driven privacy harms well ahead of any domestic AI-specific legislative response in the Bailiwick.
Other Developments
Financial-sector regulator declines sector-specific AI rules. The Guernsey Financial Services Commission, in a Policy Statement dated 29 January 2026, indicated it is understood not to be proposing specific rules or guidance in relation to the use of AI by financial-services firms it supervises, relying instead on its existing principles-based supervisory framework and pointing firms toward external reference frameworks including the NIST AI Risk Management Framework, ISO/IEC 42001 and NCSC guidance. This sits alongside, rather than in tension with, the ODPA's international AI-imagery coordination: one regulator is engaging internationally on a specific AI harm (non-consensual imagery), while the other has chosen not to issue sector-specific AI rules at all.
Cross-Monitor Connections
The AI-imagery coordination and the GFSC's AI policy stance both bear on the artificial-intelligence monitor's tracking of jurisdictional approaches to AI governance, where Guernsey's posture this period is one of international reputational and privacy-harm engagement by its data-protection authority combined with a deliberately non-prescriptive stance by its financial regulator.
Outlook
Whether the ODPA's international AI-imagery coordination feeds into any domestic legislative change, for example to Guernsey's sexual-offences legislation addressing AI-generated deepfake content, has not been confirmed at a primary-source level as at this period and is worth monitoring going forward. The GFSC's declination to issue AI-specific financial-sector rules is stated as a settled position as of 29 January 2026 rather than a proposal under consultation, so no near-term change on that front is indicated by the material reviewed.
Key regulatory facts for GG
Regulatory Dimension
GG Standing Position
Jurisdiction
GG (GG)
Regulatory Scope
Data Protection & Privacy Regulation (10 modules, 48 sourced findings)
Regulator & Framework
Core regulator, instrument and registration framework confirmed from source text and the regulator's own published guidance; some scope-provision pinpoints unconfirmed.
Lawful Processing & Special Data
Core lawful-basis and consent tests confirmed at statute level; full special-category condition list and legitimate-interests balancing-test detail remain unconfirmed gaps.
Data Subject Rights
Rights catalogue and several pinpoint sections confirmed; statutory response-deadline figure and portability test detail remain unconfirmed.
Controller/Processor Duties
Breach-notification and principles confirmed at pinpoint level; DPO threshold, ROPA exemption test and joint-controller provisions remain gaps.
Primary Instruments Cited
ICO, States of Guernsey (mirrored via DataGuidance), ODPA (mirrored via DataGuidance), GG Official Instrument (legislation.gov.uk made), GG Official Instrument (odpa.gg data-protection-authority-adjust)
Last Confirmed / Updated
2026-11-04 (26 sources in cumulative register)
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
Core regulator, instrument and registration framework confirmed from source text and the regulator's own published guidance; some scope-provision pinpoints unconfirmed.
Primary frameworkThe Data Protection (Bailiwick of Guernsey) Law, 2017
Traffic-light rationale — GreenCore regulator, instrument and registration framework confirmed from source text and the regulator's own published guidance; some scope-provision pinpoints unconfirmed.
Sub-modules (5)
Regulator And AuthorityGreen
<cite index="1-38,1-39">Part XI of the Law establishes and constitutes the Data Protection Authority, with section 60 addressing establishment and constitution and section 61 the Authority's general functions.
Claims (3):
<cite index="4-4">The Office of the Data Protection Authority (ODPA) is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation.
<cite index="1-38,1-39">Part XI of the Law (sections 60-61) establishes and constitutes the Data Protection Authority and sets out its general functions, with Schedule 6 governing the Authority's constitution.
Office of the Data Protection Authority (ODPA) — Data Protection (Bailiwick of Guernsey) Law, 2017, s.60
Act And InstrumentsGreen
The Law is supplemented by multiple Regulations and Ordinances (General Provisions Regulations 2018-2020; Commencement, Amendment and Transitional Ordinance 2018; Law Enforcement and Related Matters Ordinance 2018).
Claims (1):
<cite index="1-45,1-46,1-47">The object of the Data Protection (Bailiwick of Guernsey) Law, 2017 is to protect individuals' rights in relation to personal data and provide for free movement of personal data in a manner equivalent to the GDPR and the Law Enforcement Directive.
Material ScopeAmber
<cite index="11-10,11-11">Nothing in the Law applies to processing by an individual solely for personal, family or household affairs, including recreational purposes. The full establishment/targeting test (GDPR Art 3(2) analogue) was not located in sources retrieved this pass.
Claims (1):
<cite index="11-10,11-11">The Law does not apply to processing of personal data by an individual solely for personal, family or household affairs, including recreational purposes (section 4).
Territorial ScopeRed
No pinpoint provision setting out an extraterritorial targeting/monitoring test or a representative-appointment duty analogous to GDPR Art 27 was located in the sources retrieved this research pass.
Regulator Registration And FilingGreen
<cite index="42-8,42-9">The ODPA operates a two-tier annual levy: £2,000/year for organisations with 50 or more FTE staff, and £50/year for all other organisations. <cite index="42-12">Charities and not-for-profits must register and renew annually but are not required to pay the levy.
Claims (2):
<cite index="42-8,42-9">Since 2021 the ODPA operates a two-tier annual registration levy: £2,000/year for organisations with 50+ FTE staff and £50/year for all other registering controllers/processors. <cite index="42-12">Charities and not-for-profits must register annually but pay no levy.
Office of the Data Protection Authority (ODPA) — £62.22 for under-50-FTE organisations and £2,488.80 for 50+ FTE organisations, from 1 January 2026, adjusted in line with inflation; States of Guernsey pay £259,250 flat, charities pay nothing.
Category narrative148 words
Guernsey operates a GDPR-equivalent omnibus regime under the Data Protection (Bailiwick of Guernsey) Law, 2017, supervised by the Office of the Data Protection Authority (ODPA). <cite index="4-4">The Guernsey Office of the Data Protection Authority is the independent supervisory authority for the purposes of The Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation. <cite index="1-45,1-46,1-47">The object of the Law is to protect the rights of individuals in relation to their personal data, and provide for the free movement of personal data, in a manner equivalent to the GDPR and the Law Enforcement Directive. The Law entered into force 25 May 2018 via commencement Ordinance. Territorial-scope limbs equivalent to GDPR Art 3(2) (targeting/monitoring tests) and the Art 27 representative-appointment duty were searched for but not located in the consolidated text retrieved this pass; this is flagged as a gap requiring escalation to the official Guernsey Legal Resources text.
Sources and claims (7)
ConfirmedICO — <cite index="4-4">The Office of the Data Protection Authority (ODPA) is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="1-45,1-46,1-47">The object of the Data Protection (Bailiwick of Guernsey) Law, 2017 is to protect individuals' rights in relation to personal data and provide for free movement of personal data in a manner equivalent to the GDPR and the Law Enforcement Directive.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="11-10,11-11">The Law does not apply to processing of personal data by an individual solely for personal, family or household affairs, including recreational purposes (section 4).observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="1-38,1-39">Part XI of the Law (sections 60-61) establishes and constitutes the Data Protection Authority and sets out its general functions, with Schedule 6 governing the Authority's constitution.observed
ConfirmedODPA (mirrored via DataGuidance) — <cite index="42-8,42-9">Since 2021 the ODPA operates a two-tier annual registration levy: £2,000/year for organisations with 50+ FTE staff and £50/year for all other registering controllers/processors. <cite index="42-12">Charities and not-for-profits must register annually but pay no levy.observed
Core lawful-basis and consent tests confirmed at statute level; full special-category condition list and legitimate-interests balancing-test detail remain unconfirmed gaps.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Schedule 2
Traffic-light rationale — AmberCore lawful-basis and consent tests confirmed at statute level; full special-category condition list and legitimate-interests balancing-test detail remain unconfirmed gaps.
D2 · Lawful Processing — Full Module Record4 sub-modules · 52 words · 5 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Traffic-light rationale — AmberRights catalogue and several pinpoint sections confirmed; statutory response-deadline figure and portability test detail remain unconfirmed.
Sub-modules (5)
Access RightGreen
<cite index="1-5,1-6,1-7,1-8">The Law enumerates rights to information for directly and indirectly collected personal data, a right to data portability, and a right of access. A frivolous/vexatious/excessive-request exception permits refusal or a reasonable administrative fee.
Claims (2):
<cite index="1-5,1-6,1-7,1-8">The Law's arrangement of sections enumerates a right to information for personal data collected directly from the data subject, a right to information for indirectly collected personal data, a right to data portability, and a right of access.
<cite index="47-11">Where part of a rights request is frivolous, vexatious, unnecessarily repetitive or otherwise excessive, the controller may refuse that part, or in exceptional circumstances comply but charge a reasonable fee for administrative costs.
Rectification And ErasureGreen
<cite index="11-43,11-44,11-45,11-46">Section 20 gives a right to rectification where a data subject disputes accuracy or completeness. <cite index="1-66">Section 21 gives a right to erasure where, among other grounds, data is no longer necessary, consent is withdrawn, the subject objects, or processing is unlawful. ODPA published DSAR-handling guidance in June 2023.
Claims (3):
<cite index="11-43,11-44,11-45">Section 20 confers a right to rectification where a data subject disputes the accuracy or completeness of their personal data, exercised via a written request to the controller.
<cite index="1-66">Section 21 confers a right to erasure, including on grounds that the data is no longer necessary, consent has been withdrawn, the data subject has objected and the controller must cease processing, or the data has been unlawfully processed.
<cite index="26-4,26-7">ODPA's June 2023 guidance sets out a step-by-step process for controllers handling data subject access requests, covering acknowledgement, search, verification and delivery. This is supervisory guidance, not a binding statutory instrument.
Restriction And ObjectionGreen
<cite index="1-67,1-68">Section 22 gives a right to restriction of processing where accuracy is disputed, processing is unlawful but erasure is opposed, or data is needed for a legal claim. <cite index="77-48,77-49,77-50">Section 17 gives an objection right specific to direct-marketing processing, requiring explicit notice before or at first communication.
Claims (2):
<cite index="1-67,1-68">Section 22 confers a right to restriction of processing where the data subject disputes accuracy pending verification, opposes erasure of unlawfully processed data in favour of restriction, or needs the data retained for a legal claim.
<cite index="77-48,77-49,77-50">Section 17 applies where personal data is processed for direct marketing purposes and gives the data subject a right to require the controller to cease such processing, with the controller obliged to give notice of this right before or at first communication, explicitly and separately from other matters.
Data PortabilityAmber
A standalone right to data portability is listed in the Law's arrangement of sections; the specific pinpoint provision and scope/test were not isolated from the consolidated text retrieved this pass.
Deadlines And Response WindowsRed
No explicit statutory response-deadline figure (e.g., a one-month equivalent to GDPR Art 12(3)), extension test, or manifestly-unfounded/excessive fee threshold was located in the sources retrieved this pass, beyond the general frivolous/vexatious/excessive exception.
Category narrative46 words
The Law confers a GDPR-equivalent suite of data subject rights (information, access, portability, rectification, erasure, restriction, objection, notification of rectification/erasure/restriction, and protection against solely-automated decisions). Pinpoint statutory response-deadline figures (e.g., a one-month analogue to GDPR Art 12(3)) were not located in the sources retrieved this pass.
Sources and claims (7)
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="1-5,1-6,1-7,1-8">The Law's arrangement of sections enumerates a right to information for personal data collected directly from the data subject, a right to information for indirectly collected personal data, a right to data portability, and a right of access.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="11-43,11-44,11-45">Section 20 confers a right to rectification where a data subject disputes the accuracy or completeness of their personal data, exercised via a written request to the controller.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="1-66">Section 21 confers a right to erasure, including on grounds that the data is no longer necessary, consent has been withdrawn, the data subject has objected and the controller must cease processing, or the data has been unlawfully processed.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="1-67,1-68">Section 22 confers a right to restriction of processing where the data subject disputes accuracy pending verification, opposes erasure of unlawfully processed data in favour of restriction, or needs the data retained for a legal claim.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="77-48,77-49,77-50">Section 17 applies where personal data is processed for direct marketing purposes and gives the data subject a right to require the controller to cease such processing, with the controller obliged to give notice of this right before or at first communication, explicitly and separately from other matters.observed
ConfirmedStates of Guernsey (mirrored via DataGuidance) — <cite index="47-11">Where part of a rights request is frivolous, vexatious, unnecessarily repetitive or otherwise excessive, the controller may refuse that part, or in exceptional circumstances comply but charge a reasonable fee for administrative costs.observed
ProbableDataGuidance (news summary) — <cite index="26-4,26-7">ODPA's June 2023 guidance sets out a step-by-step process for controllers handling data subject access requests, covering acknowledgement, search, verification and delivery. This is supervisory guidance, not a binding statutory instrument.observed
Traffic-light rationale — AmberBreach-notification and principles confirmed at pinpoint level; DPO threshold, ROPA exemption test and joint-controller provisions remain gaps.
D4 · Controller & Processor — Full Module Record7 sub-modules · 52 words · 9 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Strong Tier-1 evidentiary base (EU and UK official sources) confirming adequacy status both inbound (received) and the statute's own authorised-jurisdiction mechanism; TIA and localisation sub-modules are genuine gaps.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Part X; EU Commission Decision 2003/821/EC; UK DPA 2018 Schedule 21
Traffic-light rationale — GreenStrong Tier-1 evidentiary base (EU and UK official sources) confirming adequacy status both inbound (received) and the statute's own authorised-jurisdiction mechanism; TIA and localisation sub-modules are genuine gaps.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 91 words · 8 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Only the financial_sector_overlay sub-module has supporting evidence; remaining seven sub-modules are unconfirmed gaps on a non-EU, non-EEA Crown Dependency.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Schedule 8
Traffic-light rationale — AmberOnly the financial_sector_overlay sub-module has supporting evidence; remaining seven sub-modules are unconfirmed gaps on a non-EU, non-EEA Crown Dependency.
D6 · Sectoral Watch — Full Module Record8 sub-modules · 45 words · 3 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Traffic-light rationale — AmberDark-patterns and direct-marketing sub-modules evidenced; cookies/trackers, opt-out signals, clean rooms and cross-context advertising are unconfirmed gaps.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 42 words · 3 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
ADM right confirmed at statute level and AI guidance confirmed at supervisory level; profiling, biometric, genetic and surveillance-carveout sub-modules are unconfirmed gaps.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, section 24
Traffic-light rationale — AmberADM right confirmed at statute level and AI guidance confirmed at supervisory level; profiling, biometric, genetic and surveillance-carveout sub-modules are unconfirmed gaps.
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No sub-module in this area returned a confirmed Guernsey-specific statutory provision from the sources accessible this pass; escalation to the official Guernsey Legal Resources text and/or direct ODPA guidance library is recommended.
Traffic-light rationale — Not assessedNo sub-module in this area returned a confirmed Guernsey-specific statutory provision from the sources accessible this pass; escalation to the official Guernsey Legal Resources text and/or direct ODPA guidance library is recommended.
Sub-modules (5)
Age VerificationRed
No age-of-digital-consent or age-assurance provision was located for Guernsey this pass.
Parental ConsentRed
No parental-consent mechanism provision was located for Guernsey this pass.
Minor Profiling BansRed
No minor-profiling-for-advertising prohibition was located for Guernsey this pass.
Education SettingsRed
No education-settings-specific DP rule was located for Guernsey this pass.
Dependent AdultsRed
No dependent-adults-specific DP protection was located for Guernsey this pass.
Category narrative43 words
No Guernsey-specific statutory age-of-digital-consent provision (GDPR Art 8 analogue), minor-self-exercise-of-rights age, age-assurance/children's-design-code instrument, minor-profiling prohibition, education-settings rule, or dependent-adults protection was located in the sources retrieved this research pass. This module is marked as a genuine evidentiary gap rather than a silent omission.
Enforcement architecture, complaint/court redress routes and recent enforcement activity are confirmed; the specific statutory fine-cap figures and collective-redress mechanisms remain unconfirmed gaps.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Part XII
Traffic-light rationale — AmberEnforcement architecture, complaint/court redress routes and recent enforcement activity are confirmed; the specific statutory fine-cap figures and collective-redress mechanisms remain unconfirmed gaps.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 99 words · 4 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 48 claim(s) (48 category placement(s)), 26 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 24 Oct 2026: not settled (5 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.
GG