--- title: "GG-ALD Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/guernsey-alderney/ source_html: /jurisdictions/guernsey-alderney/index.html description: "GG-ALD data protection and privacy regulation: 10 categories, 22 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 8be7e5ebc2bc831027709a7121a1da48ae48bb889e63954479d1dfe1f721ec40 generator: "fe-fleet/md-twin@1.0" --- # GG-ALD Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/guernsey-alderney/), [World Payments](https://payments.gi/jurisdictions/guernsey-alderney/), [Advennt](https://advennt.io/jurisdictions/guernsey-alderney/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 22 claims · 32 sources in the cumulative register Download report (PDF) Expand all The Office of the Data Protection Authority has partially upheld a complaint against the States of Alderney, finding that the former Chief Executive's subject-access request was answered with inconsistent and excessive redactions, in breach of section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=GUERNSEY-ALDERNEY)[Build Report](/reports/?j=GUERNSEY-ALDERNEY)[Compare](/compare/?j=GUERNSEY-ALDERNEY) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Data Protection Authority (ODPA) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 1 Red categories 58 Sub-modules 22 Claims 3 Tier-1 sources Traffic-light mix 3 green 6 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction lead brief ###### Latest update · 4 November 2026 #### Lead Signal The Office of the Data Protection Authority has confirmed that annual registration fees under the Data Protection (Bailiwick of Guernsey) Law, 2017 will rise by more than 4%, applying Bailiwick-wide and therefore reaching registered controllers in Alderney, with the increase taking effect from 1 January 2027. The fee schedule change was announced on 20 October 2026 and has not yet come into effect, so the current fee level continues to apply until the new year. #### Other Developments No further Alderney-specific development in the regulator-and-framework space has surfaced beyond the fee announcement this period. The underlying registration regime itself, under which Alderney organisations have been required to register with the Authority since 1 January 2021, remains unchanged in its basic structure; what has changed is the price of participating in it. #### Cross-Monitor Connections None identified this period for this module. #### Outlook The fee rise is a routine adjustment to the funding model of a regulator that describes itself as funded entirely by registration income, rather than a sign of any substantive change to obligations. Registered controllers Bailiwick-wide, including those based in Alderney, should expect the higher fee from the start of 2027; whether any Alderney-specific fee band is set within that schedule, as distinct from the general Bailiwick rate, has not yet been confirmed and is worth watching when the new schedule is published in full. 1 earlier update not shown here. ###### Standing brief · as of 4 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Office of the Data Protection Authority has partially upheld a complaint against the States of Alderney, finding that the former Chief Executive's subject-access request was answered with inconsistent and excessive redactions, in breach of section 15 of the Data Protection (Bailiwick of Guernsey) Law, 2017. The decision, published on 26 November 2025, is the most recent Alderney-specific enforcement and redress event on record and demonstrates that Bailiwick-wide data-protection enforcement reaches Alderney's own public-sector controllers directly, confirming that the territorial test under the Law operates in practice and not only on paper. #### Other Developments Subject-access rights in the public sector. The underlying finding concerned a controller's handling of a subject-access request: the States of Alderney, acting as controller, was found to have applied redactions to a letter provided in response to the request in a manner the ODPA assessed as inconsistent and excessive, amounting to a breach of the right of access under section 15 of the Law. This is the governing development for the data-subject-rights module this period and the first GG-ALD-specific access-rights finding of its kind identified in this evidence set. #### Cross-Monitor Connections No factual basis is present in this cycle's structured input to route this development to financial-integrity, world-payments, advennt, artificial-intelligence, or crypto; the finding concerns a public-sector subject-access complaint with no evidenced nexus to those domains this cycle. #### Outlook The ODPA's decision against the States of Alderney stands as a confirmed instance of enforcement reaching an Alderney public-sector controller under the Bailiwick-wide statute. Whether further corrective or remedial steps follow from the States of Alderney, or whether this finding prompts wider public-sector guidance on redaction practice in responding to subject-access requests, is not addressed in the evidence available this cycle. Read full brief · 548 words Key regulatory facts for GG-ALD Regulatory Dimension GG-ALD Standing Position Jurisdiction GG-ALD (GG-ALD) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 22 sourced findings) Regulator & Framework A comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement... Lawful Processing & Special Data Core lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available... Data Subject Rights Core rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates. Controller/Processor Duties Breach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap. Primary Instruments Cited Bailiwick Express, Bailiwick Express, GG-ALD Official Instrument (odpa.gg www-odpa-gg), ODPA - The Law, GG-ALD Official Instrument (dlapiperdataprotection.com index-html-t-law-c-GG) Last Confirmed / Updated 2026-11-04 (32 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### GG-ALD: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement date of the Alderney 2009 Ordinance). Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Green A comprehensive, GDPR-equivalent omnibus statute with an identified independent regulator and operative registration regime is in force; residual gaps are narrow (exact territorial-scope pinpoint, exact commencement date of the Alderney 2009 Ordinance). #### Sub-modules (5) #### Regulator And AuthorityGreen ODPA is confirmed as the independent supervisory authority for the Bailiwick, including Alderney. Claims (3): - Office of the Data Protection Authority — The ODPA is the independent supervisory authority for the Data Protection (Bailiwick of Guernsey) Law, 2017, covering Guernsey, Alderney and Sark. - Office of the Data Protection Authority (ODPA) — The Bailiwick of Guernsey's data protection regulator, delegated day-to-day regulatory functions by the Data Protection Authority under the Data Protection (Bailiwick of Guernsey) Law, 2017. - ODPA is the independent supervisory authority under the Data Protection (Bailiwick of Guernsey) Law, 2017. #### Act And InstrumentsGreen Primary instrument is the 2017 Law (in force 25 May 2018), object clause equivalent to GDPR/LED; amended/associated by several ordinances and regulations including an Alderney-specific ePrivacy ordinance. Claims (2): - Data Protection (Bailiwick of Guernsey) Law, 2017 — Came into force on 25 May 2018, replacing the 2001 Law and implementing GDPR/LED equivalence across the Bailiwick, including Alderney. - ODPA announced that annual registration fees (Bailiwick-wide, including Alderney) will rise by more than 4% from 1 January 2027. #### Material ScopeAmber Section 2 'Condition A' confirms automated-means processing is caught; the full text of 'Condition B' (manual filing systems) was not captured in retrieved sources. Claims (1): - Data Protection (Bailiwick of Guernsey) Law, 2017, s.39 — Section 39 prohibits all controllers and processors established in the Bailiwick from processing personal data unless registered with the ODPA; failure to comply is a criminal offence. #### Territorial ScopeRed No pinpoint provision equivalent to GDPR Art 3(2) targeting/monitoring test, household exclusion, or Art 27-equivalent representative duty was located for the Bailiwick Law within available sources. Claims (2): - Data-protection registration and fee obligations were extended to require Alderney organisations to register with the ODPA from 1 January 2021. - Data Protection (Bailiwick of Guernsey) Law, 2017, s.111 — An entity is 'established in the Bailiwick', and thus caught by the Law, if it is a Guernsey/Alderney/Sark person, maintains an office/branch/agency or regular practice there, causes processing equipment there to be used other than for transit, or engages in effective and real processing through stable arrangements there. #### Regulator Registration And FilingGreen Annual registration and levy regime in force since 2021 for controllers/processors established in the Bailiwick, with tiered fees and exemptions for charities. Claims (5): - The ODPA found the States of Alderney, as controller, breached section 15 of the DPL 2017 (right of access) through inconsistent and excessive redactions of a letter provided to a former Chief Executive in response to a subject-access request. - Data Protection (Bailiwick of Guernsey) Law, 2017 — The Law differentiates 'authorised jurisdictions' (including EU member states and EC-adequacy countries) from 'unauthorised jurisdictions' for cross-border transfer purposes, applicable Bailiwick-wide including Alderney. - ODPA announced that annual registration fees (Bailiwick-wide, including Alderney) will rise by more than 4% from 1 January 2027. - Office of the Data Protection Authority (ODPA) — GBP 62.22 (under 50 employees) or GBP 2,488.80 (50+ employees), a 3.7% RPI-linked increase, effective 1 January 2026; charities/not-for-profits register but pay no fee. - Data Protection (Bailiwick of Guernsey) Law, 2017, s.39 — Section 39 prohibits all controllers and processors established in the Bailiwick from processing personal data unless registered with the ODPA; failure to comply is a criminal offence. Alderney (as part of the Bailiwick of Guernsey) is governed by the Data Protection (Bailiwick of Guernsey) Law, 2017, a single omnibus statute applied across Guernsey, Alderney and Sark. The Office of the Data Protection Authority (ODPA) is the independent supervisory authority. The Law's stated object is to protect individuals' rights and provide for free movement of personal data 'in a manner equivalent to the GDPR and the Law Enforcement Directive'. Alderney also has its own historical ePrivacy transposition (the Alderney Ordinance No. VIII of 2009) listed among the instruments amending/associated with the consolidated Law. Controllers/processors established in the Bailiwick (including Alderney) must register annually with ODPA and pay a levy on a tiered scale. The precise extraterritorial/establishment test equivalent to GDPR Art 3(2) could not be confirmed from the retrieved consolidated text (truncated at the automated-means limb of the 'Condition A/B' application test in section 2). Periodic update · new data 2026-11-04 #### Regulator & Framework The Office of the Data Protection Authority is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017, a position it has held since the Law came into force on 25 May 2018. Alderney organisations have been brought within the same registration framework as the rest of the Bailiwick, required to register with the Authority from 1 January 2021. The Authority has announced that annual registration fees will rise by more than 4% from 1 January 2027, a change that applies Bailiwick-wide and therefore to registered controllers based in Alderney. The announcement was made on 20 October 2026; the increase itself has not yet come into effect and will not apply until the new year. The Authority states that it is funded entirely by registration fees and operates independently of the States of Guernsey, which situates the fee rise as a funding-model adjustment internal to the regulator's own financing rather than a change to the substance of what registered controllers must do. Whether a separate fee band applies specifically to Alderney-registered organisations, distinct from the general Bailiwick-wide schedule, has not been confirmed and will depend on the detail of the published 2027 fee schedule. #### Outlook Controllers registered in Alderney should plan for the higher registration cost from the start of 2027 while the obligation to register itself remains unchanged. The open question is whether the new schedule treats Alderney organisations identically to the rest of the Bailiwick or introduces any differentiated band; that will only be settled once the Authority publishes the full 2027 fee table. Sources and claims (9) - [Bailiwick Express](https://www.bailiwickexpress.com/business-ge/data-protection-registration-fees-to-rise/) — ODPA announced that annual registration fees (Bailiwick-wide, including Alderney) will rise by more than 4% from 1 January 2027. - [Bailiwick Express](https://www.bailiwickexpress.com/business-ge/register-now-with-the-odpa/) — Office of the Data Protection Authority (ODPA) — GBP 62.22 (under 50 employees) or GBP 2,488.80 (50+ employees), a 3.7% RPI-linked increase, effective 1 January 2026; charities/not-for-profits register but pay no fee. - [https://www.odpa.gg/](https://www.odpa.gg/) — Office of the Data Protection Authority — The ODPA is the independent supervisory authority for the Data Protection (Bailiwick of Guernsey) Law, 2017, covering Guernsey, Alderney and Sark. - [ODPA - The Law](https://www.odpa.gg/information-hub/law) — Data Protection (Bailiwick of Guernsey) Law, 2017 — Came into force on 25 May 2018, replacing the 2001 Law and implementing GDPR/LED equivalence across the Bailiwick, including Alderney. - [https://www.dlapiperdataprotection.com/index.html?t=law&c=GG](https://www.dlapiperdataprotection.com/index.html?t=law&c=GG) — Data Protection (Bailiwick of Guernsey) Law, 2017, s.39 — Section 39 prohibits all controllers and processors established in the Bailiwick from processing personal data unless registered with the ODPA; failure to comply is a criminal offence. - [https://www.dlapiperdataprotection.com/index.html?t=authority&c=GG](https://www.dlapiperdataprotection.com/index.html?t=authority&c=GG) — Office of the Data Protection Authority (ODPA) — The Bailiwick of Guernsey's data protection regulator, delegated day-to-day regulatory functions by the Data Protection Authority under the Data Protection (Bailiwick of Guernsey) Law, 2017. - [https://www.odpa.gg/](https://www.odpa.gg/) — ODPA is the independent supervisory authority under the Data Protection (Bailiwick of Guernsey) Law, 2017. - [Bailiwick Express](https://www.bailiwickexpress.com/news-ge/data-protection-requirements-extended-guernsey/) — Data-protection registration and fee obligations were extended to require Alderney organisations to register with the ODPA from 1 January 2021. - [ODPA guidance - 'Established in the Bailiwick'](https://www.odpa.gg/sites/default/files/2025-09/2020.12.18%20Established%20in%20the%20Bailiwick.pdf) — Data Protection (Bailiwick of Guernsey) Law, 2017, s.111 — An entity is 'established in the Bailiwick', and thus caught by the Law, if it is a Guernsey/Alderney/Sark person, maintains an office/branch/agency or regular practice there, causes processing equipment there to be used other than for transit, or engages in effective and real processing through stable arrangements there. ### GG-ALD: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available sources in this pass. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Schedule 2 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Core lawful-basis architecture is confirmed and closely GDPR-aligned, but several pinpoint sub-tests (special-category conditions list, further-processing compatibility factors) were not retrievable from available sources in this pass. D2 · Lawful Processing — Full Module Record 4 sub-modules · 123 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Core rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Part III Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Green Core rights architecture, deadlines and the direct-marketing objection right are confirmed from the consolidated statutory text with in-force dates. #### Sub-modules (5) #### Access RightGreen Right of access sits alongside the information and portability rights in Part III; ODPA issued DSAR process guidance in 2023. Claims indexed in baseline register · source extraction in progress #### Rectification And ErasureAmber No pinpoint erasure-grounds provision was retrieved distinct from the general Part III rights architecture. Claims (1): - Alderney data subjects hold statutory rights to rectification, erasure in certain circumstances, and restriction of processing under the Bailiwick of Guernsey Law. #### Restriction And ObjectionGreen Sections 17-19 give an absolute objection right for direct marketing and a conditional cessation right where processing rests on public-task/legitimate-interests or historical/scientific-purpose conditions. Claims indexed in baseline register · source extraction in progress #### Data PortabilityAmber Portability right is listed in the Part III arrangement of sections alongside access; detailed scope/exceptions text not retrieved. #### Deadlines And Response WindowsGreen The 'designated period' for indirect-collection information duties and other Part III requests is one month from the relevant day, extendable with notice. Claims indexed in baseline register · source extraction in progress Part III of the Law confers rights modelled on GDPR Arts 13-22, including rights to information (direct and indirect collection), access, portability, objection (direct marketing is an absolute right; public-task/legitimate-interests processing carries a qualified cessation right), and protection against solely automated decision-making (section 24), the latter surviving even the Schedule 8 trusts exemption. The statutory response window ('the designated period') is one month, extendable with notice to the requester. ODPA has issued non-binding DSAR-handling guidance (June 2023). No Guernsey-specific minors'-capacity-to-exercise-rights-alone provision was located. No periodic updates recorded in this cycle Sources and claims (1) - [States of Alderney - Data Protection](https://alderney.gov.gg/dp) — Alderney data subjects hold statutory rights to rectification, erasure in certain circumstances, and restriction of processing under the Bailiwick of Guernsey Law. ### GG-ALD: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Part IV Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Breach-notification and joint-controller duties are confirmed at a high level of statutory detail (deadlines, thresholds, exemptions); DPIA and DPO threshold specifics are an unresolved gap. D4 · Controller & Processor — Full Module Record 7 sub-modules · 138 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Both EU-side and UK-side adequacy status for the Bailiwick (covering Alderney) are confirmed as currently in force via primary/official sources; secondary transfer-mechanism detail (SCC uptake, localisation, TIA test) is a gap. Primary framework Commission Decision 2003/821/EC (EU adequacy); UK Data Protection Act 2018 adequacy regulations Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Green Both EU-side and UK-side adequacy status for the Bailiwick (covering Alderney) are confirmed as currently in force via primary/official sources; secondary transfer-mechanism detail (SCC uptake, localisation, TIA test) is a gap. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 132 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ One strong Alderney-specific instrument (the 2009 ePrivacy Ordinance) is confirmed; most other sectoral sub-modules carry no confirmed Bailiwick-specific overlay and are recorded as explicit gaps. Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber One strong Alderney-specific instrument (the 2009 ePrivacy Ordinance) is confirmed; most other sectoral sub-modules carry no confirmed Bailiwick-specific overlay and are recorded as explicit gaps. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 143 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A concrete Alderney-specific enforcement/outreach action on dark patterns in gambling is confirmed, but the underlying statutory cookie-consent and dark-pattern-prohibition pinpoints were not retrieved. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017 (general); Alderney Ordinance No. VIII of 2009 (ePrivacy, for electronic communications context) Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber A concrete Alderney-specific enforcement/outreach action on dark patterns in gambling is confirmed, but the underlying statutory cookie-consent and dark-pattern-prohibition pinpoints were not retrieved. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 105 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The core ADM-protection right and ODPA's AI guidance are confirmed; biometric-specific rules and any AI Act interface analysis remain unconfirmed gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, section 24 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber The core ADM-protection right and ODPA's AI guidance are confirmed; biometric-specific rules and any AI Act interface analysis remain unconfirmed gaps. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 100 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No children-and-vulnerable-groups-specific statutory pinpoint was retrievable for the Bailiwick despite multiple targeted search passes; this module is reported as an explicit, flagged gap rather than silently omitted. Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Red No children-and-vulnerable-groups-specific statutory pinpoint was retrievable for the Bailiwick despite multiple targeted search passes; this module is reported as an explicit, flagged gap rather than silently omitted. D9 · Children's Privacy — Full Module Record 5 sub-modules · 68 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG-ALD: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement cooperation activity and an appeal route are confirmed; the core penalty/fine-amount and collective-redress mechanics -- central to this module -- remain unconfirmed gaps requiring primary-source escalation. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Enforcement cooperation activity and an appeal route are confirmed; the core penalty/fine-amount and collective-redress mechanics -- central to this module -- remain unconfirmed gaps requiring primary-source escalation. Periodic update · new data 2026-10-25 #### Enforcement & Redress Two developments touch enforcement and redress in this period, one concerning a reprimand and the other concerning the Authority's international standing. The Channel Islands Financial Ombudsman is reported to have received a second data-protection reprimand, this one following a complaint about a response to a Subject Access Request that was described as lacking clarity. Reports indicate a first reprimand was issued in 2020 by the Guernsey Authority, after an email containing special-category data was sent to the wrong recipient. Both reprimands concern the Ombudsman's own handling of personal data rather than its function as a dispute-resolution body for financial services complaints across the Bailiwick, including Alderney. This history, if accurate, suggests a recurring vulnerability in the Ombudsman's data-handling practices across two separate incident types, misdirected special-category data in the earlier case and inadequate clarity in responding to a Subject Access Request in the more recent one. These reports rest on a secondary summary rather than the Authority's own primary enforcement register, and the detail available this period, including the precise date and reasoning of the more recent reprimand, has not been corroborated against that primary source. Readers should treat the account of the second reprimand as reported rather than as confirmed pending that corroboration. Separately, the Authority's own institutional standing was reinforced through its reported election to the Executive Committee of the Global Privacy Assembly, announced 11 May 2026, attributed to its role as co-chair or secretariat of the Global Privacy Assembly's International Enforcement Cooperation Working Group. While this is an institutional and international-cooperation development rather than a domestic enforcement action, it bears on the Authority's own capacity and standing as an enforcement body, including its participation in cross-border enforcement cooperation mechanisms that could, in principle, support future redress efforts for data subjects in the Bailiwick. No other enforcement action, decision, or redress development specific to Alderney was identified this period. #### Outlook Corroboration of the Channel Islands Financial Ombudsman reprimand against the Authority's own primary enforcement register would sharpen confidence in the account reported here. The Authority's continued participation in the Global Privacy Assembly's Executive Committee and International Enforcement Cooperation Working Group may support further cross-border enforcement cooperation activity, though no specific future action has been identified at this time. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 148 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions