Not publishable as-is. 1 of 7 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
GG-ALD
GG-ALDschema gdpri-v2trajectory: not yet assessedregulated (omnibus)overlaps: FIM, WPM, Advennt, AIC
The Office of the Data Protection Authority has partially upheld a complaint against the States of Alderney, finding that the former Chief Executive's subject-access request was answered with inconsistent and excessive redactions, in breach of section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017.
Data collected · Data published
AI-assembled from cited sources
Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.
10 categories · 0
claims · 21 sources in the cumulative register
10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
0Claimsbaseline..claims[]
3Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix(sums to 10 rendered categories; click to filter)
No red categories; 20 sub-modules are flagged red.
Jurisdiction lead brief
Standing brief, as of 4 October 2026.
Lead Signal
The Office of the Data Protection Authority has partially upheld a complaint against the States of Alderney, finding that the former Chief Executive's subject-access request was answered with inconsistent and excessive redactions, in breach of section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017. The decision, published on 26 November 2025, is the most recent Alderney-specific enforcement and redress event on record and demonstrates that Bailiwick-wide data-protection enforcement reaches Alderney's own public-sector controllers directly, confirming that the territorial test under the Law operates in practice and not only on paper.
Other Developments
Subject-access rights in the public sector. The underlying finding concerned a controller's handling of a subject-access request: the States of Alderney, acting as controller, was found to have applied redactions to a letter provided in response to the request in a manner the ODPA assessed as inconsistent and excessive, amounting to a breach of the right of access under section 15 of the Law. This is the governing development for the data-subject-rights module this period and the first GG-ALD-specific access-rights finding of its kind identified in this evidence set.
Cross-Monitor Connections
No factual basis is present in this cycle's structured input to route this development to financial-integrity, world-payments, advennt, artificial-intelligence, or crypto; the finding concerns a public-sector subject-access complaint with no evidenced nexus to those domains this cycle.
Outlook
The ODPA's decision against the States of Alderney stands as a confirmed instance of enforcement reaching an Alderney public-sector controller under the Bailiwick-wide statute. Whether further corrective or remedial steps follow from the States of Alderney, or whether this finding prompts wider public-sector guidance on redaction practice in responding to subject-access requests, is not addressed in the evidence available this cycle.
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
A comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement date of the Alderney 2009 Ordinance).
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017
Traffic-light rationale — GreenA comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement date of the Alderney 2009 Ordinance).
Sub-modules (5)
Regulator And AuthorityGreen
ODPA is confirmed as the independent supervisory authority for the Bailiwick, including Alderney.
Claims (1):
CLM-GG-ALD-001 (claim on file)
Act And InstrumentsGreen
Primary instrument is the 2017 Law (in force 25 May 2018), object clause equivalent to GDPR/LED; amended/associated by several ordinances and regulations including an Alderney-specific ePrivacy ordinance.
Claims (2):
CLM-GG-ALD-002 (claim on file)
CLM-GG-ALD-003 (claim on file)
Material ScopeAmber
Section 2 'Condition A' confirms automated-means processing is caught; the full text of 'Condition B' (manual filing systems) was not captured in retrieved sources.
Absence provenance: Only Condition A (automated means) text was retrieved; Condition B limb not located in accessible sources.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-004 (claim on file)
Territorial ScopeRed
No pinpoint provision equivalent to GDPR Art 3(2) targeting/monitoring test, household exclusion, or Art 27-equivalent representative duty was located for the Bailiwick Law within available sources.
Absence provenance: Consolidated text excerpts retrieved did not include this provision; recommend direct retrieval of full consolidated Law from Guernsey Legal Resources.. Searched: unavailable.
Regulator Registration And FilingGreen
Annual registration and levy regime in force since 2021 for controllers/processors established in the Bailiwick, with tiered fees and exemptions for charities.
Claims (2):
CLM-GG-ALD-005 (claim on file)
CLM-GG-ALD-006 (claim on file)
Category narrative147 words
Alderney (as part of the Bailiwick of Guernsey) is governed by the Data Protection (Bailiwick of Guernsey) Law, 2017, a single omnibus statute applied across Guernsey, Alderney and Sark. The Office of the Data Protection Authority (ODPA) is the independent supervisory authority. The Law's stated object is to protect individuals' rights and provide for free movement of personal data 'in a manner equivalent to the GDPR and the Law Enforcement Directive'. Alderney also has its own historical ePrivacy transposition (the Alderney Ordinance No. VIII of 2009) listed among the instruments amending/associated with the consolidated Law. Controllers/processors established in the Bailiwick (including Alderney) must register annually with ODPA and pay a levy on a tiered scale. The precise extraterritorial/establishment test equivalent to GDPR Art 3(2) could not be confirmed from the retrieved consolidated text (truncated at the automated-means limb of the 'Condition A/B' application test in section 2).
Core lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available sources in this pass.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Schedule 2
Traffic-light rationale — AmberCore lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available sources in this pass.
Sub-modules (4)
Lawful BasesGreen
Section 7 sets the Schedule 2 gateway test for lawfulness.
Claims (1):
CLM-GG-ALD-007 (claim on file)
Consent ThresholdsAmber
ODPA's January 2024 guidance sets non-binding supervisory expectations for valid consent.
Claims (1):
CLM-GG-ALD-008 (claim on file)
Special CategoriesAmber
Special category data requires a Part II or III Schedule 2 condition; the itemised list of conditions was not retrieved.
Absence provenance: Schedule 2 condition list not located in accessible excerpts.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-007 (claim on file)
Pseudonymisation And AnonymisationGreen
The Law defines anonymisation by reference to the controller's own re-identification capability.
Claims (1):
CLM-GG-ALD-009 (claim on file)
Category narrative123 words
Lawfulness under the Law is structured around Schedule 2: general processing requires a condition in Part I or II, while special category data requires a condition in Part II or III. The anonymisation test is controller-capability based: data are 'anonymised' only where the controller is not capable of identifying the data subject. Accountability/privacy-by-design duties require technical and organisational measures to comply with the principles and to minimise processing by default, with pseudonymisation cited as an example measure. ODPA has issued (non-binding) supervisory guidance on consent (January 2024) applying GDPR-equivalent validity standards (freely given, specific, granular, withdrawable). Guernsey-specific pinpoints for the Art 9(2) special-category conditions, the Art 6(4)-equivalent further-processing compatibility test, and any national legitimate-interests balancing-test statement were not located in the retrieved material.
Traffic-light rationale — GreenCore rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates.
Sub-modules (5)
Access RightGreen
Right of access sits alongside the information and portability rights in Part III; ODPA issued DSAR process guidance in 2023.
Claims (1):
CLM-GG-ALD-012 (claim on file)
Rectification And ErasureAmber
No pinpoint erasure-grounds provision was retrieved distinct from the general Part III rights architecture.
Absence provenance: Erasure provision section number/text not located in retrieved excerpts.. Searched: unavailable.
Restriction And ObjectionGreen
Sections 17-19 give an absolute objection right for direct marketing and a conditional cessation right where processing rests on public-task/legitimate-interests or historical/scientific-purpose conditions.
Claims (2):
CLM-GG-ALD-010 (claim on file)
CLM-GG-ALD-011 (claim on file)
Data PortabilityAmber
Portability right is listed in the Part III arrangement of sections alongside access; detailed scope/exceptions text not retrieved.
Absence provenance: Section heading confirmed; operative text not retrieved.. Searched: unavailable.
Deadlines And Response WindowsGreen
The 'designated period' for indirect-collection information duties and other Part III requests is one month from the relevant day, extendable with notice.
Claims (2):
CLM-GG-ALD-010 (claim on file)
CLM-GG-ALD-011 (claim on file)
Category narrative83 words
Part III of the Law confers rights modelled on GDPR Arts 13-22, including rights to information (direct and indirect collection), access, portability, objection (direct marketing is an absolute right; public-task/legitimate-interests processing carries a qualified cessation right), and protection against solely automated decision-making (section 24), the latter surviving even the Schedule 8 trusts exemption. The statutory response window ('the designated period') is one month, extendable with notice to the requester. ODPA has issued non-binding DSAR-handling guidance (June 2023). No Guernsey-specific minors'-capacity-to-exercise-rights-alone provision was located.
Breach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, Part IV
Traffic-light rationale — AmberBreach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap.
Sub-modules (7)
Accountability And DpiaAmber
Accountability/by-design duties require technical and organisational measures incl. pseudonymisation as an example; the national DPIA trigger list was not located.
Absence provenance: No Guernsey-specific DPIA trigger list located; UK ICO DPIA criteria are not transposable without confirmation.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-009 (claim on file)
Dpo RequirementsAmber
Registration materials reference organisations 'the Law requires to appoint a Data Protection Officer' as a distinct registration category, confirming a DPO-appointment duty exists, but the precise headcount/activity threshold was not retrieved.
Absence provenance: Only an indirect reference (registration exemption category) was found; the operative threshold section text was not retrieved.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-005 (claim on file)
Ropa RequirementsRed
No ROPA exemption test (headcount/risk limb) was located for the Bailiwick Law.
Absence provenance: Not located in retrieved excerpts.. Searched: unavailable.
Joint Controller ArrangementsGreen
Section 33 requires joint controllers to explicitly agree respective Part III compliance responsibilities.
Claims (1):
CLM-GG-ALD-013 (claim on file)
Security MeasuresAmber
General accountability/security duties are implied by the by-design provisions; a dedicated Art 32-equivalent security-of-processing section text was not isolated.
Claims (1):
CLM-GG-ALD-009 (claim on file)
Breach NotificationGreen
Sections 42-43 set a 72-hour regulator-notification standard and a high-risk-to-significant-interests threshold for data-subject notification, each with documented exemptions.
Claims (5):
CLM-GG-ALD-014 (claim on file)
CLM-GG-ALD-015 (claim on file)
CLM-GG-ALD-016 (claim on file)
CLM-GG-ALD-017 (claim on file)
CLM-GG-ALD-018 (claim on file)
Retention And DisposalAmber
No pinpoint Guernsey retention-limit provision was located beyond the general storage-limitation principle referenced in the consolidated text.
Absence provenance: Only the general storage-limitation principle heading was retrieved, not a standalone retention/disposal duty.. Searched: unavailable.
Category narrative138 words
Section 42 requires controllers to notify ODPA of a personal data breach 'as soon as practicable' and in any event no later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to the significant interests of a data subject; phased follow-up notification is permitted. Section 43 requires notification to affected data subjects where there is a high risk to their significant interests, subject to exemptions (prior encryption/technical measures, subsequent risk-mitigating measures, or disproportionate effort substituted by publication). Controllers must keep a written breach log (section 42(6)). Processors must notify controllers of breaches as soon as aware (section 42(1)). Joint controllers (section 33) must explicitly apportion Part III compliance responsibilities. DPIA trigger lists and any DPO headcount/activity threshold stricter or different from GDPR Art 37 could not be confirmed from available sources.
Both EU-side and UK-side adequacy status for the Bailiwick (covering Alderney) are confirmed as currently in force via primary/official sources; secondary transfer-mechanism detail (SCC uptake, localisation, TIA test) is a gap.
Primary frameworkCommission Decision 2003/821/EC (EU adequacy); UK Data Protection Act 2018 adequacy regulations
Traffic-light rationale — GreenBoth EU-side and UK-side adequacy status for the Bailiwick (covering Alderney) are confirmed as currently in force via primary/official sources; secondary transfer-mechanism detail (SCC uptake, localisation, TIA test) is a gap.
Sub-modules (6)
Transfer MechanismsAmber
Transfers from Guernsey are governed by the Law's adequacy/safeguards framework; Guernsey enjoys EU and UK adequacy, reducing reliance on SCCs for flows to/from those blocs. Domestic transfer-mechanism pinpoints beyond adequacy were not located.
Claims (2):
CLM-GG-ALD-019 (claim on file)
CLM-GG-ALD-021 (claim on file)
Adequacy ReceivedAmber
Guernsey has not itself received inbound adequacy findings from other regimes as a data-importer jurisdiction in the material reviewed; this sub-module concerns adequacy granted TO Guernsey, addressed below under adequacy_granted by convention of the two decisions found.
Absence provenance: No evidence found that Guernsey itself issues outbound adequacy findings; Guernsey functions primarily as an adequacy recipient.. Searched: unavailable.
Adequacy GrantedGreen
The EU adequacy decision (2003/821/EC, reconfirmed 2024) and UK adequacy regulations (general and law-enforcement-specific) both treat Guernsey, including Alderney, as adequate.
Claims (4):
CLM-GG-ALD-020 (claim on file)
CLM-GG-ALD-021 (claim on file)
CLM-GG-ALD-019 (claim on file)
CLM-GG-ALD-022 (claim on file)
Sccs And BcrsRed
No Guernsey-specific SCC/BCR uptake data or local clause-set requirement was located.
Absence provenance: Not located in available sources.. Searched: unavailable.
Transfer Impact AssessmentRed
No statutory TIA requirement or ODPA TIA guidance was located for the Bailiwick.
Absence provenance: Not located.. Searched: unavailable.
Data LocalisationRed
No data-localisation mandate was identified for the Bailiwick.
Absence provenance: Not located; no evidence of a localisation mandate was found.. Searched: unavailable.
Category narrative132 words
Guernsey (including Alderney) holds a long-standing EU Commission adequacy finding, originally made in 2003 under Directive 95/46/EC, which the European Commission's first periodic review (2024) confirmed continues to meet the GDPR adequacy standard, citing the 2017 Law as the modernising instrument. Separately, Guernsey benefits from UK-side adequacy treatment: the Bailiwick is a 'third country' for UK GDPR purposes but UK adequacy regulations permit transfers without additional safeguards, and a distinct UK Home Office adequacy assessment and ICO opinion cover Guernsey's law-enforcement-sector processing specifically (reviewed every four years from commencement). ODPA participates in EDPB-adjacent international enforcement cooperation networks and is noted as being under a specific national-law duty to provide cross-border investigative assistance. Guernsey-specific SCC/BCR uptake practice, a domestic data-localisation provision, and a national transfer-impact-assessment statutory test were not located in available sources.
One strong Alderney-specific instrument (the 2009 ePrivacy Ordinance) is confirmed; most other sectoral sub-modules carry no confirmed Bailiwick-specific overlay and are recorded as explicit gaps.
Traffic-light rationale — AmberOne strong Alderney-specific instrument (the 2009 ePrivacy Ordinance) is confirmed; most other sectoral sub-modules carry no confirmed Bailiwick-specific overlay and are recorded as explicit gaps.
Sub-modules (8)
Financial Sector OverlayAmber
GFSC-regulated entities may act as ODPA Levy Collection Agents; no further banking-secrecy or open-finance DP overlay was located.
Absence provenance: Only the administrative LCA role was confirmed.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-023 (claim on file)
Health Sector OverlayRed
No health-sector-specific DP overlay was located for the Bailiwick beyond the general 'health data' definition referenced in ODPA exemptions guidance.
Absence provenance: Not located.. Searched: unavailable.
Telecoms And EprivacyGreen
Alderney's communications-data regime traces to the 2009 Ordinance implementing the EU ePrivacy Directive framework for the island.
Claims (1):
CLM-GG-ALD-024 (claim on file)
Employment DataAmber
A Schedule 8 exemption narrows Part III rights for confidential employment/education references; no standalone employment-data code equivalent to GDPR Art 88 was located.
Claims (1):
CLM-GG-ALD-025 (claim on file)
Credit And ScoringRed
No credit-scoring-specific regime was located.
Absence provenance: Not located.. Searched: unavailable.
EducationAmber
The exemptions guidance references 'marking data'/exam-results timing exemptions but no broader education-sector DP code was located.
Absence provenance: Only the exam-marking-data exemption timing rule was found, not a full education code.. Searched: unavailable.
InsuranceRed
No insurance-sector-specific DP overlay was located.
Absence provenance: Not located.. Searched: unavailable.
Data Access SharingRed
No local Guernsey/Alderney smart-data, data-portability or Data-Act-equivalent access-sharing scheme was located; the EU Data Act (Regulation (EU) 2023/2854) is not domestic law in the Bailiwick.
Absence provenance: No evidence of a domestic analogue or of specific extraterritorial application findings was located in this pass.. Searched: unavailable.
Category narrative143 words
Alderney has its own historical ePrivacy transposition, the European Communities (Implementation of Council Directive on Privacy and Electronic Communications) (Alderney) Ordinance, 2009, distinct from the parallel Guernsey (2004) and Sark (2004) instruments referenced in the consolidated Law's amendment history -- this is the clearest Alderney-specific sectoral finding identified. A limited financial-sector administrative nexus exists: GFSC-regulated entities may act as ODPA 'Levy Collection Agents', but no distinct financial-sector data-access/open-banking overlay was found. A Schedule 8 'confidential references' exemption narrows Part III rights for employment/education-reference data. No Guernsey-specific health-sector overlay, credit-scoring regime, education-sector DP code, insurance-sector overlay, or EU-Data-Act-equivalent local data-access/smart-data scheme was located; the EU Data Act is an EU-level instrument and Alderney/Guernsey sit outside the EU, so it does not apply as domestic law, though EU-facing Guernsey suppliers may still be caught by the Data Act's own territorial scope (not independently verified here).
A concrete Alderney-specific enforcement/outreach action on dark patterns in gambling is confirmed, but the underlying statutory cookie-consent and dark-pattern-prohibition pinpoints were not retrieved.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017 (general); Alderney Ordinance No. VIII of 2009 (ePrivacy, for electronic communications context)
Traffic-light rationale — AmberA concrete Alderney-specific enforcement/outreach action on dark patterns in gambling is confirmed, but the underlying statutory cookie-consent and dark-pattern-prohibition pinpoints were not retrieved.
Sub-modules (6)
Cookies And TrackersAmber
Alderney's 2009 Ordinance transposes the EU ePrivacy framework; the specific consent-standard pinpoint and maximum penalty for the cookie provision were not retrieved.
Absence provenance: Ordinance's existence and title confirmed; operative cookie-consent text and penalty not retrieved.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-024 (claim on file)
Dark PatternsAmber
ODPA's September 2024 outreach to Alderney gambling operators on dark patterns is supervisory engagement, not a codified statutory prohibition.
Claims (1):
CLM-GG-ALD-026 (claim on file)
Opt Out SignalsRed
No Global Privacy Control or DAA-equivalent opt-out-signal recognition was located for the Bailiwick.
Absence provenance: Not located.. Searched: unavailable.
Clean Rooms And DcrRed
No clean-room/data-collaboration-room rules were located.
Absence provenance: Not located.. Searched: unavailable.
Cross Context AdvertisingRed
No CPRA-style 'sale'/'share' equivalent concept was located for the Bailiwick.
Absence provenance: Not located; Bailiwick regime does not appear to use a CPRA-style framework.. Searched: unavailable.
Direct MarketingGreen
Section 17 gives an absolute statutory right to object to direct marketing processing.
Claims (1):
CLM-GG-ALD-010 (claim on file)
Category narrative105 words
The clearest Alderney-specific finding in this module is ODPA's September 2024 outreach to Alderney gambling-sector companies regarding the use of dark patterns, following the 2024 Global Privacy Enforcement Network (GPEN) sweep in which ODPA focused on the gambling sector. ODPA's January 2024 consent guidance (non-binding) states that its freely-given/specific/granular/withdrawable consent standard extends to automated-decision-making and international-transfer contexts, which by extension would apply to consent-based cookie/tracking use, though no pinpoint cookie-consent statutory provision for Guernsey/Alderney (equivalent to ePrivacy Art 5(3)) was isolated distinct from the Alderney 2009 Ordinance reference. No consent-or-pay position, dark-pattern statutory prohibition (as opposed to supervisory outreach), or direct-marketing soft-opt-in rule was located.
The core ADM-protection right and ODPA's AI guidance are confirmed; biometric-specific rules and any AI Act interface analysis remain unconfirmed gaps.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017, section 24
Traffic-light rationale — AmberThe core ADM-protection right and ODPA's AI guidance are confirmed; biometric-specific rules and any AI Act interface analysis remain unconfirmed gaps.
Sub-modules (6)
Profiling RestrictionsAmber
No standalone profiling-restriction provision distinct from the ADM right (section 24) was located.
Claims (1):
CLM-GG-ALD-027 (claim on file)
Automated Decision Making TransparencyGreen
Section 24's right not to be subject to solely automated decisions is preserved even where other Part III rights are exempted for trust data, indicating structural priority given to this right.
Claims (1):
CLM-GG-ALD-027 (claim on file)
Ai Risk AssessmentsAmber
ODPA's May 2023 AI guidance is supervisory and non-binding; no statutory AI-specific risk-assessment duty was located.
Claims (1):
CLM-GG-ALD-028 (claim on file)
Biometric RegimeRed
No biometric-specific processing condition or facial-recognition position was located for the Bailiwick.
Absence provenance: Not located.. Searched: unavailable.
Genetic DataRed
No genetic-data-specific regime was located beyond its likely inclusion within the general special-category data definition.
Absence provenance: Not located.. Searched: unavailable.
State Surveillance CarveoutsAmber
The Law Enforcement and Related Matters Ordinance 2018 modifies the general Law for competent-authority law-enforcement processing, but the national-security/state-surveillance carve-out limits were not independently verified.
Absence provenance: Existence of the Law Enforcement Ordinance confirmed; specific carve-out limits not retrieved.. Searched: unavailable.
Category narrative100 words
The Law confers a right not to be subject to decisions based solely on automated processing (section 24); this right is explicitly carved out of (i.e. preserved despite) the Schedule 8 trusts exemption, indicating it is treated as close to non-derogable within the statutory exemption architecture. ODPA published non-binding guidance (26 May 2023) clarifying how data protection law applies to personal data used within AI systems, including what is classified as AI. No EU AI Act interface findings apply domestically (Alderney/Guernsey are outside the EU), no biometric-specific processing condition, and no facial-recognition position statement were located in the sources reviewed.
No children-and-vulnerable-groups-specific statutory pinpoint was retrievable for the Bailiwick despite multiple targeted search passes; this module is reported as an explicit, flagged gap rather than silently omitted.
Traffic-light rationale — Not assessedNo children-and-vulnerable-groups-specific statutory pinpoint was retrievable for the Bailiwick despite multiple targeted search passes; this module is reported as an explicit, flagged gap rather than silently omitted.
Sub-modules (5)
Age VerificationRed
No age-verification requirement was located.
Absence provenance: Not located.. Searched: unavailable.
Parental ConsentRed
No Guernsey-specific parental-consent age threshold (Art 8 GDPR analogue) was located.
Absence provenance: Not located in any retrieved source despite targeted search.. Searched: unavailable.
Minor Profiling BansRed
No minor-profiling prohibition was located.
Absence provenance: Not located.. Searched: unavailable.
Education SettingsAmber
Only the exam-marking-data timing exemption (Schedule 8) was located, not a broader education-settings DP code.
Absence provenance: Only an exemption-timing rule for exam results was found.. Searched: unavailable.
Dependent AdultsRed
No dependent-adults-specific DP provision was located, though the 'protective functions' exemption category references protection from financial loss due to incompetence/unfitness in certain service contexts.
Absence provenance: Only a tangential 'protective functions' exemption category was located.. Searched: unavailable.
Category narrative68 words
No Guernsey/Alderney-specific statutory age of digital consent (the local equivalent of GDPR Art 8), minors'-own-exercise-of-rights age threshold, age-assurance/children's-design-code instrument, or minor-profiling prohibition was located in the sources reviewed, despite repeated targeted searches. The Law's general object clause commits to GDPR-equivalent protection, which implies children's rights exist, but no primary-source pinpoint confirming whether Guernsey has set a derogated age (as EU/UK Member States have done, e.g. 13-16) was found.
Enforcement cooperation activity and an appeal route are confirmed; the core penalty/fine-amount and collective-redress mechanics -- central to this module -- remain unconfirmed gaps requiring primary-source escalation.
Primary frameworkData Protection (Bailiwick of Guernsey) Law, 2017
Traffic-light rationale — AmberEnforcement cooperation activity and an appeal route are confirmed; the core penalty/fine-amount and collective-redress mechanics -- central to this module -- remain unconfirmed gaps requiring primary-source escalation.
Sub-modules (6)
Regulator Powers And PenaltiesRed
No pinpoint statutory maximum fine/penalty figure or fine-calculation methodology was located for the Bailiwick Law.
Absence provenance: Only offence-related exemption cross-references (e.g. exclusion of the offence-prevention exemption for offences under the Law itself) were located; no monetary penalty figure was retrieved.. Searched: unavailable.
Enforcement Activity IndexAmber
The joint Prospect Custodian Trustees Ltd breach investigation (announced Dec 2025/Jan 2026) is the most recent confirmed enforcement-adjacent activity involving ODPA.
Claims (1):
CLM-GG-ALD-029 (claim on file)
Regulator Funding And CapacityGreen
ODPA is self-funded via the registration/levy regime introduced from 2021, intended to secure its independence from the States of Guernsey and to underpin the EU adequacy finding.
Claims (2):
CLM-GG-ALD-005 (claim on file)
CLM-GG-ALD-006 (claim on file)
Collective Redress And Class ActionsRed
No Art 80 GDPR-equivalent representative-action mechanism or Representative Actions Directive transposition was located (Guernsey is outside the EU and not bound by that Directive).
Absence provenance: Not located.. Searched: unavailable.
Private Right Of ActionAmber
No standalone private-right-of-action provision distinct from the Schedule 8 Royal Court appeal route was located.
Claims (1):
CLM-GG-ALD-030 (claim on file)
Recent Developments 180DAmber
Within the last 180 days (approx. April-October 2026), the most significant confirmed development is the ongoing joint ICO/ODPA/JOIC/IOM investigation into the Prospect Custodian Trustees Ltd breach, continuing from its December 2025 announcement; no new Bailiwick legislative amendment, adequacy redetermination, or fresh ODPA statutory guidance was identified as published within this window.
Absence provenance: No qualifying new instrument or guidance beyond the ongoing joint investigation was located.. Searched: unavailable.
Claims (1):
CLM-GG-ALD-029 (claim on file)
Category narrative148 words
ODPA, jointly with the UK ICO, the Jersey Office of the Information Commissioner and the Isle of Man Information Commissioner, launched a coordinated cross-border investigation into the 2025 Prospect Custodian Trustees Ltd data breach, with each regulator investigating compliance with the law it individually oversees. Schedule 8 exemption-certificate decisions carry a right of appeal to the Royal Court. Guernsey's DPA is noted by the EDPB as being specifically required by national law to provide cross-border investigative assistance to other data protection authorities, and Guernsey participates in the 2025 roster of non-EEA DPAs holding an EU adequacy decision within EDPB-adjacent cooperation networks. The precise statutory maximum administrative fine/penalty figure under the Bailiwick Law, the regulator's fine-calculation methodology, any private-right-of-action or representative/collective-redress mechanism, and limitation periods for complaints were not located in the sources reviewed and are flagged as explicit gaps rather than assumed equivalent to UK or EU figures.
no periodic updates on record for this sub-brief
No categories match.
Filters combine as OR inside a group and AND across
groups.
Publication gate
Blocking. 1 failing check(s).
schema_valid
pass
min_quoted_text_present
waived — floor 0%
translation_provenance_recorded
n/a — no subject in this jurisdiction
egress_verified
pass
min_t1_per_instrument_met
pass
jurisdiction_source_floor_met
pass
source_tier_integrity_ok
pass
manual_override
FAIL
tier_a_b_national_primary_pct
62.5
aggregator_only_jurisdiction_count
0
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for GG-ALD
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
no reviewer on record
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score; derived_scores = {}.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 0 claim(s) (0 category placement(s)), 21 source(s) in the cumulative register.
regulator_and_framework, lawful_processing_and_special_data, data_subject_rights, controller_processor_duties (breach notification sub-module) and cross_border_and_adequacy are grounded on T1/T2 sources (the consolidated Law text, ODPA's own guidance documents, EU Official Journal/Commission report, UK ICO opinions). adtech_and_commercial_privacy and algorithmic_biometric_and_surveillance_governance rely on a mix of T2 (ODPA guidance) and T3 (DataGuidance news summaries of ODPA actions) for the Alderney-specific gambling/dark-patterns and AI-guidance findings. sectoral_watch is thin outside telecoms_and_eprivacy (the Alderney 2009 Ordinance, T1-referenced) and the financial_sector_overlay LCA fact (T2); health, credit, education, insurance and data_access_sharing sub-modules are explicit T4-equivalent gaps (no source located). children_and_vulnerable_groups and enforcement_and_redress's regulator_powers_and_penalties sub-module are the weakest-evidenced areas: no Guernsey-specific age-of-consent figure or statutory maximum fine amount was retrievable in this research pass despite multiple targeted searches, and both are flagged red with absent_field_provenance rather than inferred from UK/EU analogues.
Unresolved questions (9):
What is the Guernsey Data Protection (Bailiwick) Law 2017's statutory maximum administrative fine/penalty figure, and what fine-calculation methodology does ODPA apply?
What is the DPO mandatory-appointment threshold (headcount/activity test) under the Bailiwick Law, and does it diverge from GDPR Art 37?
What is the national DPIA mandatory-trigger list (statutory provision or ODPA-published list) for the Bailiwick?
Does Guernsey/Alderney set a specific age of digital consent (Art 8 GDPR analogue) or minors'-own-rights-exercise age, and in which provision?
What is the full text and commencement date of section 2's 'Condition B' (material scope) and the Law's own extraterritorial/targeting test (Art 3(2) analogue), including any Art 27-equivalent representative-appointment duty?
What is the precise adoption/publication date of Commission Decision 2003/821/EC and of the 2024 Commission periodic-review report (COM document 52024DC0007), for effective_date pinpointing?
Is there a Guernsey mainland (as distinct from Alderney) cookie/ePrivacy transposition instrument, and what is its consent-standard pinpoint and maximum penalty?
Does the EU Data Act (Regulation (EU) 2023/2854) apply extraterritorially to Guernsey/Alderney-based suppliers serving the EU market, and is there any local data-access/smart-data analogue?
What representative/collective-redress or private-right-of-action mechanism, if any, exists under the Bailiwick Law distinct from the Schedule 8 Royal Court appeal route?