GG

Regulator And AuthorityGreen

<cite index="1-38,1-39">Part XI of the Law establishes and constitutes the Data Protection Authority, with section 60 addressing establishment and constitution and section 61 the Authority's general functions.</cite>

Claims (2):

• <cite index="4-4">The Office of the Data Protection Authority (ODPA) is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation.</cite>
• <cite index="1-38,1-39">Part XI of the Law (sections 60-61) establishes and constitutes the Data Protection Authority and sets out its general functions, with Schedule 6 governing the Authority's constitution.</cite>

Act And InstrumentsGreen

The Law is supplemented by multiple Regulations and Ordinances (General Provisions Regulations 2018-2020; Commencement, Amendment and Transitional Ordinance 2018; Law Enforcement and Related Matters Ordinance 2018).

Claims (1):

• <cite index="1-45,1-46,1-47">The object of the Data Protection (Bailiwick of Guernsey) Law, 2017 is to protect individuals' rights in relation to personal data and provide for free movement of personal data in a manner equivalent to the GDPR and the Law Enforcement Directive.</cite>

Material ScopeAmber

<cite index="11-10,11-11">Nothing in the Law applies to processing by an individual solely for personal, family or household affairs, including recreational purposes.</cite> The full establishment/targeting test (GDPR Art 3(2) analogue) was not located in sources retrieved this pass.

Claims (1):

• <cite index="11-10,11-11">The Law does not apply to processing of personal data by an individual solely for personal, family or household affairs, including recreational purposes (section 4).</cite>

Territorial ScopeRed

No pinpoint provision setting out an extraterritorial targeting/monitoring test or a representative-appointment duty analogous to GDPR Art 27 was located in the sources retrieved this research pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law territorial scope section 3, Guernsey Data Protection Law representative appointment non-established controller.

Regulator Registration And FilingGreen

<cite index="42-8,42-9">The ODPA operates a two-tier annual levy: £2,000/year for organisations with 50 or more FTE staff, and £50/year for all other organisations.</cite> <cite index="42-12">Charities and not-for-profits must register and renew annually but are not required to pay the levy.</cite>

Claims (1):

• <cite index="42-8,42-9">Since 2021 the ODPA operates a two-tier annual registration levy: £2,000/year for organisations with 50+ FTE staff and £50/year for all other registering controllers/processors.</cite> <cite index="42-12">Charities and not-for-profits must register annually but pay no levy.</cite>

Lawful BasesAmber

<cite index="11-17,11-18">Processing is lawful for the purposes of the Lawfulness, Fairness and Transparency principle only if at least one Schedule 2 condition is satisfied (Part I or II for ordinary data, Part II or III for special category data).</cite>

Claims (1):

• <cite index="11-17,11-18">For the purposes of the Lawfulness, Fairness and Transparency principle, processing of personal data is lawful only if at least one condition in Schedule 2 Part I or II (ordinary data) or Part II or III (special category data) is satisfied (section 7).</cite>

Consent ThresholdsGreen

<cite index="11-25">Consent means any specific, informed and unambiguous indication of the data subject's wishes, by statement or clear affirmative action, signifying agreement to processing.</cite> ODPA published non-binding consent guidance in January 2024.

Claims (2):

• <cite index="11-25">Consent given by a data subject means any specific, informed and unambiguous indication of the data subject's wishes, by a statement or clear affirmative action, signifying agreement to processing (section 10(1)).</cite>
• <cite index="84-5,84-6,84-7">ODPA's January 2024 consent guidance requires consent to be freely given, specific and granular, prominent, unbundled from other terms, concise, user-friendly and age-appropriate.</cite> This is supervisory guidance, not a binding statutory amendment.

Special CategoriesAmber

<cite index="11-18">Special category data requires at least one condition in Schedule 2 Part II or III to be satisfied.</cite> The enumerated conditions themselves were not retrieved in full this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law Schedule 2 Part II III special category conditions.

Claims (1):

• <cite index="11-18">Special category data may only be processed lawfully where at least one condition in Part II or III of Schedule 2 is satisfied (section 7(1)(a)).</cite> The specific enumerated Schedule 2 Part II/III conditions were not retrieved in full text this pass.

Pseudonymisation And AnonymisationGreen

<cite index="11-26">Anonymised personal data is defined as data manipulated or treated such that the controller is not capable of identifying the data subject.</cite> <cite index="1-58,1-59">Where data is anonymised, the Law does not require the controller to acquire or process additional information solely to comply with the Law, but the controller must take reasonable steps to notify the data subject of the anonymisation.</cite>

Claims (1):

• <cite index="11-26">'Anonymised', in relation to personal data, means the data is manipulated or treated such that the controller is not capable of identifying the data subject (section 10(3)).</cite> <cite index="1-58,1-59">Where data is anonymised, the controller need not retain additional identifying information to comply with the Law, but must take reasonable steps to notify the data subject of the anonymisation (section 11).</cite>

Access RightGreen

<cite index="1-5,1-6,1-7,1-8">The Law enumerates rights to information for directly and indirectly collected personal data, a right to data portability, and a right of access.</cite> A frivolous/vexatious/excessive-request exception permits refusal or a reasonable administrative fee.

Claims (2):

• <cite index="1-5,1-6,1-7,1-8">The Law's arrangement of sections enumerates a right to information for personal data collected directly from the data subject, a right to information for indirectly collected personal data, a right to data portability, and a right of access.</cite>
• <cite index="47-11">Where part of a rights request is frivolous, vexatious, unnecessarily repetitive or otherwise excessive, the controller may refuse that part, or in exceptional circumstances comply but charge a reasonable fee for administrative costs.</cite>

Rectification And ErasureGreen

<cite index="11-43,11-44,11-45,11-46">Section 20 gives a right to rectification where a data subject disputes accuracy or completeness.</cite> <cite index="1-66">Section 21 gives a right to erasure where, among other grounds, data is no longer necessary, consent is withdrawn, the subject objects, or processing is unlawful.</cite> ODPA published DSAR-handling guidance in June 2023.

Claims (3):

• <cite index="11-43,11-44,11-45">Section 20 confers a right to rectification where a data subject disputes the accuracy or completeness of their personal data, exercised via a written request to the controller.</cite>
• <cite index="1-66">Section 21 confers a right to erasure, including on grounds that the data is no longer necessary, consent has been withdrawn, the data subject has objected and the controller must cease processing, or the data has been unlawfully processed.</cite>
• <cite index="26-4,26-7">ODPA's June 2023 guidance sets out a step-by-step process for controllers handling data subject access requests, covering acknowledgement, search, verification and delivery.</cite> This is supervisory guidance, not a binding statutory instrument.

Restriction And ObjectionGreen

<cite index="1-67,1-68">Section 22 gives a right to restriction of processing where accuracy is disputed, processing is unlawful but erasure is opposed, or data is needed for a legal claim.</cite> <cite index="77-48,77-49,77-50">Section 17 gives an objection right specific to direct-marketing processing, requiring explicit notice before or at first communication.</cite>

Claims (2):

• <cite index="1-67,1-68">Section 22 confers a right to restriction of processing where the data subject disputes accuracy pending verification, opposes erasure of unlawfully processed data in favour of restriction, or needs the data retained for a legal claim.</cite>
• <cite index="77-48,77-49,77-50">Section 17 applies where personal data is processed for direct marketing purposes and gives the data subject a right to require the controller to cease such processing, with the controller obliged to give notice of this right before or at first communication, explicitly and separately from other matters.</cite>

Data PortabilityAmber

A standalone right to data portability is listed in the Law's arrangement of sections; the specific pinpoint provision and scope/test were not isolated from the consolidated text retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law right to data portability section text.

Deadlines And Response WindowsRed

No explicit statutory response-deadline figure (e.g., a one-month equivalent to GDPR Art 12(3)), extension test, or manifestly-unfounded/excessive fee threshold was located in the sources retrieved this pass, beyond the general frivolous/vexatious/excessive exception.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law subject access request response deadline one month.

Accountability And DpiaAmber

<cite index="11-16">The Law's seven principles are Lawfulness/Fairness/Transparency, Purpose Limitation, Minimisation, Accuracy, Storage Limitation, Integrity and Confidentiality, and Accountability, the last requiring the controller to demonstrate compliance.</cite> DPIA trigger-list detail was not retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law DPIA mandatory triggers list.

Claims (1):

• <cite index="11-16">The Law requires controllers to comply with seven data protection principles: Lawfulness/Fairness/Transparency, Purpose Limitation, Minimisation, Accuracy, Storage Limitation, Integrity and Confidentiality, and Accountability (the controller being responsible for and able to demonstrate compliance) (section 6).</cite>

Dpo RequirementsAmber

<cite index="5-9">ODPA's registration/levy guidance confirms that entities the Law requires to appoint a Data Protection Officer are a distinct levy-liable category.</cite> The specific statutory appointment threshold (headcount/activity test) was not retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law DPO appointment threshold section.

Claims (1):

• <cite index="5-9">The ODPA registration/levy regime treats entities the Law requires to appoint a Data Protection Officer as a distinct levy-liable category, confirming a statutory DPO-appointment duty exists for defined controllers.</cite> The precise statutory headcount/activity threshold triggering mandatory appointment was not retrieved this pass.

Ropa RequirementsRed

No ROPA exemption test (headcount/risk limbs) was located in sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law records of processing activities exemption.

Joint Controller ArrangementsRed

No joint-controller provision was located in sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law joint controller arrangement provision.

Security MeasuresGreen

<cite index="3-12">Where a controller uses a processor, the processor is required under section 42(1) to notify the controller of a breach as soon as it becomes aware of it.</cite>

Claims (1):

• <cite index="3-12">Where a controller uses a processor's services, the processor is required under section 42(1) to notify the controller of a breach as soon as the processor becomes aware of it.</cite>

Breach NotificationGreen

<cite index="3-9">Controllers must give the Authority written notice of a personal data breach as soon as practicable and in any event no later than 72 hours after becoming aware of it.</cite> <cite index="3-16">Where the breach is likely to pose a high risk to a data subject's significant interests, the controller must also notify affected individuals.</cite>

Claims (3):

• <cite index="3-9">Controllers must give the ODPA written notice of a personal data breach as soon as practicable and in any event no later than 72 hours after becoming aware of it (section 42(2)), with phased follow-up information permitted where full details are not yet available.</cite>
• <cite index="3-16">Where a breach is likely to pose a high risk to the significant interests of a data subject, the controller must notify affected individuals as soon as practicable, in clear and plain language, describing the nature of the breach and providing DPO/contact details, likely consequences, and mitigation measures (section 43).</cite> <cite index="12-22">Notification to data subjects is not required where appropriate technical/organisational measures (e.g. encryption) render the breach harmless, or where notification would involve disproportionate effort (in which case a public notice must be published instead).</cite>
• <cite index="3-2,3-3">Controllers must keep a written record of each personal data breach of which they are aware, including the facts, effects and remedial action taken (section 42(6)).</cite>

Retention And DisposalGreen

<cite index="11-16">The Storage Limitation principle requires personal data not be kept in identifiable form longer than necessary for the processing purpose, save that it may be retained longer for a historical or scientific purpose.</cite>

Claims (1):

• <cite index="11-16">The Storage Limitation principle requires that personal data not be kept in identifiable form longer than necessary for the purpose for which it is processed, save that it may be stored longer to the extent necessary for a historical or scientific purpose.</cite>

Transfer MechanismsGreen

<cite index="1-28,1-29,1-30,1-31,1-32,1-33,1-34,1-35,1-36,1-37">Part X of the Law sets out: prohibition of transfers to unauthorised jurisdictions (s.55); transfers on the basis of available safeguards (s.56); transfers on the basis of Authority authorisation (s.57); approval of binding corporate rules (s.58); and other authorised transfers (s.59).</cite>

Claims (2):

• <cite index="1-28,1-29,1-30,1-31,1-32,1-33,1-37">Part X of the Law establishes: a prohibition of transfers to unauthorised jurisdictions (s.55); transfers on the basis of available safeguards (s.56); transfers authorised directly by the Authority (s.57); and other authorised transfers (s.59).</cite>
• <cite index="29-8">Guernsey's DPA is specifically required by national law to take steps to provide cross-border investigative assistance to other data protection authorities.</cite>

Adequacy ReceivedGreen

<cite index="13-4,13-5">The European Commission found Guernsey to provide adequate protection for personal data transferred from the Community under Directive 95/46/EC (Decision 2003/821/EC).</cite> <cite index="59-31">The Commission's January 2024 review concluded Guernsey continues to ensure an adequate level of protection for personal data transferred from the EU.</cite> <cite index="58-34,58-35">Guernsey is also already adequate for transfers under the UK GDPR per Schedule 21 paragraph 5(2)(d) of the DPA 2018.</cite>

Claims (4):

• <cite index="13-4,13-5">Commission Decision 2003/821/EC of 21 November 2003 found the Bailiwick of Guernsey to provide an adequate level of protection for personal data transferred from the Community for the purposes of Article 25(2) of Directive 95/46/EC.</cite>
• <cite index="59-6">The Guernsey adequacy decision adopted under the Data Protection Directive remained in force upon the GDPR's entry into application on 25 May 2018, per GDPR Article 45(9).</cite> <cite index="59-31">The European Commission's first-review report, published 15 January 2024, concluded that Guernsey continues to ensure an adequate level of protection for personal data transferred from the EU.</cite>
• <cite index="58-34,58-35">The Bailiwick of Guernsey is already adequate for personal data transferred under the UK General Data Protection Regulation, per paragraph 5(2)(d) of Schedule 21 to the UK Data Protection Act 2018.</cite>
• <cite index="6-9">For Guernsey's separate UK law-enforcement-processing adequacy regulations, the UK Secretary of State must undertake a review of the level of data protection in Guernsey every four years from the date the regulations come into force.</cite>

Adequacy GrantedGreen

<cite index="15-24,15-25">Guernsey law treats countries found adequate by the European Commission as 'authorised jurisdictions' only for so long as that adequacy finding remains in force, automatically aligning Guernsey's own outward transfer authorisations with EU adequacy decisions.</cite>

Claims (1):

• <cite index="15-24,15-25">The Data Protection Law provides that countries found adequate by the European Commission are only considered 'authorised jurisdictions' for Guernsey outward-transfer purposes as long as the EU adequacy finding remains in force, ensuring automatic alignment between EU adequacy decisions and Guernsey's own data-transfer authorisations.</cite>

Sccs And BcrsGreen

<cite index="1-34,1-35">Section 58 of the Law provides for Authority approval of binding corporate rules as a transfer mechanism, with Schedule 5 specifying matters to be addressed in BCRs.</cite>

Claims (1):

• <cite index="1-34,1-35">Section 58 of the Law provides for Authority approval of binding corporate rules as a lawful transfer mechanism.</cite>

Transfer Impact AssessmentRed

No statutory transfer-impact-assessment requirement or regulator TIA guidance was located in sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey ODPA transfer impact assessment guidance.

Data LocalisationRed

No data-localisation mandate was located in sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law data localisation requirement.

Financial Sector OverlayAmber

<cite index="16-6,16-7,16-8">Schedule 8 exempts personal data processed for a law enforcement purpose or for tax assessment/collection from specified provisions of the Law.</cite> <cite index="80-5,80-6">A related exemption addresses persons licensed under the Protection of Investors (Bailiwick of Guernsey) Law 1987 or holding a Financial Services and Markets Act 2000 Part 4A corporate-finance-service permission.</cite> ODPA breach-escalation training materials list the Guernsey Financial Services Commission alongside the ODPA in an internal escalation chain, evidencing inter-regulator coordination for regulated entities.

Claims (3):

• ODPA breach-reporting training materials place the Guernsey Financial Services Commission within the internal escalation chain alongside the Data Protection Officer and ODPA for regulated-sector breach handling, evidencing informal coordination rather than a distinct statutory overlay.
• <cite index="16-6,16-7,16-8">Schedule 8 exemption 14 exempts personal data processed for a law enforcement purpose or for the assessment or collection of tax, duty or similar imposition (including related interest/penalties) from specified provisions of the Law.</cite>
• <cite index="80-5,80-6">A Schedule 8 exemption addresses persons licensed under Part I of the Protection of Investors (Bailiwick of Guernsey) Law 1987, or exempted persons under Part IV of that Law, and persons permitted under Part 4A of the Financial Services and Markets Act 2000 to carry on a corporate finance service.</cite>

Health Sector OverlayRed

No health-sector-specific DP overlay provision beyond the general 'health data' definition (Schedule 8) was located this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law health sector overlay.

Telecoms And EprivacyRed

No ePrivacy-equivalent telecoms transposition (traffic/location data retention and access rules) was located for Guernsey this pass.

Absence provenance: unavailable. Searched: Guernsey ePrivacy telecoms data retention law.

Employment DataRed

No Guernsey employment-specific data provision analogous to GDPR Art 88 was located this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law employment data provision.

Credit And ScoringRed

No credit-scoring-specific rule was located this pass.

Absence provenance: unavailable. Searched: Guernsey credit scoring data protection rule.

EducationRed

No education-sector-specific DP rule was located this pass.

Absence provenance: unavailable. Searched: Guernsey education sector data protection rule.

InsuranceRed

No insurance-sector-specific DP rule was located this pass.

Absence provenance: unavailable. Searched: Guernsey insurance sector data protection rule.

Data Access SharingRed

Guernsey is outside the EU/EEA; the EU Data Act (Regulation (EU) 2023/2854) has no local implementing or enforcement instrument identified, and no local smart-data/data-portability scheme was located this pass.

Absence provenance: unavailable. Searched: Guernsey Data Act equivalent smart data scheme, Guernsey local implementation EU Data Act 2023/2854.

Cookies And TrackersRed

No dedicated statutory cookie/tracker consent provision (ePrivacy Art 5(3) analogue) was located in Guernsey law sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey cookie consent law ePrivacy equivalent.

Dark PatternsGreen

<cite index="27-2,27-3">In February 2024 ODPA joined the GPEN international 'privacy sweep' on deceptive design patterns, focusing on gambling sites.</cite> <cite index="30-1,30-2">In September 2024, ODPA contacted Alderney gambling-sector companies regarding dark-pattern use, following the sweep results.</cite>

Claims (2):

• <cite index="27-2,27-3">On 1 February 2024, ODPA announced participation in the GPEN international privacy sweep investigating deceptive design patterns, with its investigation concentrating on gambling sites.</cite>
• <cite index="30-1,30-2">On 23 September 2024, ODPA announced that companies in Alderney's gambling sector had been contacted regarding dark-pattern use, following results of the earlier 2024 GPEN privacy sweep.</cite>

Opt Out SignalsRed

No Global Privacy Control / opt-out-signal provision was located this pass.

Absence provenance: unavailable. Searched: Guernsey opt-out signal Global Privacy Control.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rule was located this pass.

Absence provenance: unavailable. Searched: Guernsey data clean room rule.

Cross Context AdvertisingRed

No cross-context-advertising-specific rule (CPRA 'sale'/'share' analogue) was located this pass.

Absence provenance: unavailable. Searched: Guernsey cross context advertising rule.

Direct MarketingGreen

<cite index="77-48,77-49,77-50">Section 17 of the Law gives data subjects an objection right specific to direct-marketing processing, requiring explicit prior notice from the controller.</cite>

Claims (1):

• <cite index="77-48,77-49,77-50">Section 17 applies where personal data is processed for direct marketing purposes, giving the data subject a right to require the controller to cease such processing, with notice of that right required before or at the controller's first communication, explicitly and separately from other matters.</cite>

Profiling RestrictionsRed

No profiling-specific provision distinct from the solely-automated-decision right (section 24) was located this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law profiling restriction provision.

Automated Decision Making TransparencyGreen

<cite index="1-25">The Law confers a right not to be subject to decisions based on automated processing.</cite> <cite index="77-56">This right applies where a decision is based solely on automated processing of personal data and affects the significant interests of the data subject (section 24).</cite>

Claims (1):

• <cite index="77-56">Section 24 gives a data subject the right not to be subject to a decision that is based solely on automated processing of personal data relating to them and that affects their significant interests.</cite>

Ai Risk AssessmentsGreen

<cite index="7-1,7-2">On 26 May 2023, ODPA published guidance on how data protection law applies to personal data use within AI systems, clarifying the classification of AI and the key data-protection considerations.</cite>

Claims (1):

• <cite index="7-1,7-2,7-3">On 26 May 2023, ODPA published guidance clarifying what is classified as AI and the key data-protection aspects that must be understood and implemented when using personal data within AI systems.</cite> This is non-binding supervisory guidance, not a statutory AI-risk-assessment duty.

Biometric RegimeRed

No Guernsey-specific biometric-data processing condition or facial-recognition position was confirmed from sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law biometric data condition facial recognition.

Genetic DataRed

No Guernsey-specific genetic-data regime was confirmed this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law genetic data regime.

State Surveillance CarveoutsRed

No Guernsey-specific state-surveillance carveout provision was confirmed from reliable primary sources this pass; a Regulation of Investigatory Powers framework for Guernsey may exist but could not be verified to a pinpoint this pass.

Absence provenance: unavailable. Searched: Guernsey Regulation of Investigatory Powers Law national security exemption.

Age VerificationRed

No age-of-digital-consent or age-assurance provision was located for Guernsey this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law age of consent information society services, Guernsey age assurance children design code.

Parental ConsentRed

No parental-consent mechanism provision was located for Guernsey this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law parental consent provision.

Minor Profiling BansRed

No minor-profiling-for-advertising prohibition was located for Guernsey this pass.

Absence provenance: unavailable. Searched: Guernsey minor profiling advertising prohibition.

Education SettingsRed

No education-settings-specific DP rule was located for Guernsey this pass.

Absence provenance: unavailable. Searched: Guernsey education settings data protection rule.

Dependent AdultsRed

No dependent-adults-specific DP protection was located for Guernsey this pass.

Absence provenance: unavailable. Searched: Guernsey dependent adults data protection provision.

Regulator Powers And PenaltiesAmber

<cite index="31-2,31-3,31-4">Part XII of the Law provides for sanctions following breach determination, specific provisions concerning administrative fines, and statutory limits on administrative fines.</cite> The precise fine-cap quantum (fixed amount and/or turnover percentage) was not retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law administrative fine maximum amount Schedule.

Claims (1):

• <cite index="31-2,31-3,31-4">Part XII of the Law ('Enforcement by the Authority') contains provisions on sanctions following breach determination, specific provisions concerning administrative fines, and statutory limits on administrative fines.</cite> The specific fine-cap figures were not retrieved from accessible sources this pass.

Enforcement Activity IndexAmber

<cite index="97-3,97-4">ODPA is participating in a joint investigation, opened around December 2025, into a cyber incident at Prospect Custodian Trustees Ltd affecting over 160,000 members and involving sensitive data categories.</cite>

Claims (1):

• <cite index="97-3,97-4">ODPA is participating, alongside the UK ICO, Jersey JOIC and the Isle of Man Information Commissioner, in a joint investigation into a cyber incident at Prospect Custodian Trustees Ltd affecting over 160,000 members, involving financial data and sensitive categories such as trade union membership, ethnic origin, sexual orientation, disability and religious belief.</cite> <cite index="97-14">Prospect reported the breach, which took place in June 2025, to the ICO, with the joint investigation opened in the ensuing months.</cite> The investigation is ongoing and no final decision or fine has been reported.

Regulator Funding And CapacityGreen

<cite index="5-18">ODPA's independent levy-funding model is explicitly designed to safeguard the Bailiwick's EU Commission adequacy decision.</cite>

Claims (1):

• <cite index="5-17,5-18">ODPA operates as a self-funded independent regulator via the registration levy, a model explicitly intended to safeguard the Bailiwick's European Commission adequacy decision, which is essential to the Guernsey economy.</cite>

Collective Redress And Class ActionsRed

No GDPR Art 80-equivalent representative-action or collective-redress mechanism was located in sources retrieved this pass.

Absence provenance: unavailable. Searched: Guernsey Data Protection Law representative action collective redress.

Private Right Of ActionGreen

<cite index="31-6">Where a controller fails to comply with a request, it must notify the requestor of the right to complain to the Authority under section 67 and the right to bring an action under section 79.</cite>

Claims (1):

• <cite index="31-6">A data subject whose request a controller fails to fully comply with must be notified of the right to complain to the Authority under section 67 and the right to bring a court action under section 79.</cite>

Recent Developments 180DAmber

No Guernsey-specific regulatory development strictly within the last 180 days (i.e. since approximately April 2026) was identified in this research pass. The most proximate substantive item identified — the joint Prospect breach investigation — was first announced in December 2025, which falls just outside the strict 180-day window though well within the 12-month enforcement-activity window.

Absence provenance: unavailable. Searched: Guernsey ODPA news 2026 recent development, Guernsey Data Protection Law amendment 2026.