--- title: "GG Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/gg-data-protection-privacy-regulation/ source_html: /jurisdictions/guernsey/index.html description: "GG data protection and privacy regulation: 10 categories, 48 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 077261fe1c1ca0d32509c6bbe81d3c31052e32f1294b7ed47e6132c9ea1f836f generator: "fe-fleet/md-twin@1.0" --- # GG Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/guernsey/), [World Payments](https://payments.gi/jurisdictions/guernsey/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 48 claims · 26 sources in the cumulative register Download report (PDF) Expand all The Office of the Data Protection Authority (ODPA) co-signed, on 23 February 2026, a Joint Statement on AI-Generated Imagery and the Protection of Privacy together with sixty other data protection authorities worldwide, addressing non-consensual deepfake imagery with particular concern for children. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Lawful Processing & Special Data, Algorithmic, Biometric & Surveillance Governance (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=GUERNSEY)[Build Report](/reports/?j=GUERNSEY)[Compare](/compare/?j=GUERNSEY) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Data Protection Authority (ODPA) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 0 Red categories 58 Sub-modules 48 Claims 6 Tier-1 sources Traffic-light mix 2 green 7 amber 1 n/a (sums to 10 rendered categories; click to filter) No red categories; 27 sub-modules are flagged red. ## Jurisdiction lead brief Standing brief, as of 25 October 2026. #### Lead Signal The Office of the Data Protection Authority (ODPA) co-signed, on 23 February 2026, a Joint Statement on AI-Generated Imagery and the Protection of Privacy together with sixty other data protection authorities worldwide, addressing non-consensual deepfake imagery with particular concern for children. This is a coordinated international supervisory position rather than a binding Guernsey statutory rule, but it places Guernsey's data-protection regulator in active international alignment on AI-driven privacy harms well ahead of any domestic AI-specific legislative response in the Bailiwick. #### Other Developments Financial-sector regulator declines sector-specific AI rules. The Guernsey Financial Services Commission, in a Policy Statement dated 29 January 2026, indicated it is understood not to be proposing specific rules or guidance in relation to the use of AI by financial-services firms it supervises, relying instead on its existing principles-based supervisory framework and pointing firms toward external reference frameworks including the NIST AI Risk Management Framework, ISO/IEC 42001 and NCSC guidance. This sits alongside, rather than in tension with, the ODPA's international AI-imagery coordination: one regulator is engaging internationally on a specific AI harm (non-consensual imagery), while the other has chosen not to issue sector-specific AI rules at all. #### Cross-Monitor Connections The AI-imagery coordination and the GFSC's AI policy stance both bear on the artificial-intelligence monitor's tracking of jurisdictional approaches to AI governance, where Guernsey's posture this period is one of international reputational and privacy-harm engagement by its data-protection authority combined with a deliberately non-prescriptive stance by its financial regulator. #### Outlook Whether the ODPA's international AI-imagery coordination feeds into any domestic legislative change, for example to Guernsey's sexual-offences legislation addressing AI-generated deepfake content, has not been confirmed at a primary-source level as at this period and is worth monitoring going forward. The GFSC's declination to issue AI-specific financial-sector rules is stated as a settled position as of 29 January 2026 rather than a proposal under consultation, so no near-term change on that front is indicated by the material reviewed. Read full brief · 329 words Key regulatory facts for GG Regulatory Dimension GG Standing Position Jurisdiction GG (GG) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 48 sourced findings) Regulator & Framework Core regulator, instrument and registration framework confirmed from source text and the regulator's own published guidance; some scope-provision pinpoints unconfirmed. Lawful Processing & Special Data Core lawful-basis and consent tests confirmed at statute level; full special-category condition list and legitimate-interests balancing-test detail remain unconfirmed gaps. Data Subject Rights Rights catalogue and several pinpoint sections confirmed; statutory response-deadline figure and portability test detail remain unconfirmed. Controller/Processor Duties Breach-notification and principles confirmed at pinpoint level; DPO threshold, ROPA exemption test and joint-controller provisions remain gaps. Primary Instruments Cited ICO, States of Guernsey (mirrored via DataGuidance), ODPA (mirrored via DataGuidance), GG Official Instrument (legislation.gov.uk made), GG Official Instrument (odpa.gg data-protection-authority-adjust) Last Confirmed / Updated 2026-11-04 (26 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### GG: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core regulator, instrument and registration framework confirmed from source text and the regulator's own published guidance; some scope-provision pinpoints unconfirmed. Primary framework The Data Protection (Bailiwick of Guernsey) Law, 2017 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Green Core regulator, instrument and registration framework confirmed from source text and the regulator's own published guidance; some scope-provision pinpoints unconfirmed. #### Sub-modules (5) #### Regulator And AuthorityGreen Part XI of the Law establishes and constitutes the Data Protection Authority, with section 60 addressing establishment and constitution and section 61 the Authority's general functions. Claims (3): - The Office of the Data Protection Authority (ODPA) is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation. - Part XI of the Law (sections 60-61) establishes and constitutes the Data Protection Authority and sets out its general functions, with Schedule 6 governing the Authority's constitution. - Office of the Data Protection Authority (ODPA) — Data Protection (Bailiwick of Guernsey) Law, 2017, s.60 #### Act And InstrumentsGreen The Law is supplemented by multiple Regulations and Ordinances (General Provisions Regulations 2018-2020; Commencement, Amendment and Transitional Ordinance 2018; Law Enforcement and Related Matters Ordinance 2018). Claims (1): - The object of the Data Protection (Bailiwick of Guernsey) Law, 2017 is to protect individuals' rights in relation to personal data and provide for free movement of personal data in a manner equivalent to the GDPR and the Law Enforcement Directive. #### Material ScopeAmber Nothing in the Law applies to processing by an individual solely for personal, family or household affairs, including recreational purposes. The full establishment/targeting test (GDPR Art 3(2) analogue) was not located in sources retrieved this pass. Claims (1): - The Law does not apply to processing of personal data by an individual solely for personal, family or household affairs, including recreational purposes (section 4). #### Territorial ScopeRed No pinpoint provision setting out an extraterritorial targeting/monitoring test or a representative-appointment duty analogous to GDPR Art 27 was located in the sources retrieved this research pass. #### Regulator Registration And FilingGreen The ODPA operates a two-tier annual levy: £2,000/year for organisations with 50 or more FTE staff, and £50/year for all other organisations. Charities and not-for-profits must register and renew annually but are not required to pay the levy. Claims (2): - Since 2021 the ODPA operates a two-tier annual registration levy: £2,000/year for organisations with 50+ FTE staff and £50/year for all other registering controllers/processors. Charities and not-for-profits must register annually but pay no levy. - Office of the Data Protection Authority (ODPA) — £62.22 for under-50-FTE organisations and £2,488.80 for 50+ FTE organisations, from 1 January 2026, adjusted in line with inflation; States of Guernsey pay £259,250 flat, charities pay nothing. Guernsey operates a GDPR-equivalent omnibus regime under the Data Protection (Bailiwick of Guernsey) Law, 2017, supervised by the Office of the Data Protection Authority (ODPA). The Guernsey Office of the Data Protection Authority is the independent supervisory authority for the purposes of The Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation. The object of the Law is to protect the rights of individuals in relation to their personal data, and provide for the free movement of personal data, in a manner equivalent to the GDPR and the Law Enforcement Directive. The Law entered into force 25 May 2018 via commencement Ordinance. Territorial-scope limbs equivalent to GDPR Art 3(2) (targeting/monitoring tests) and the Art 27 representative-appointment duty were searched for but not located in the consolidated text retrieved this pass; this is flagged as a gap requiring escalation to the official Guernsey Legal Resources text. Sources and claims (7) - [ICO](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-to-investigate-prospect-data-breach-with-guernsey-jersey-and-isle-of-man-counterparts/) — The Office of the Data Protection Authority (ODPA) is the independent supervisory authority for the purposes of the Data Protection (Bailiwick of Guernsey) Law, 2017 and associated legislation. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — The object of the Data Protection (Bailiwick of Guernsey) Law, 2017 is to protect individuals' rights in relation to personal data and provide for free movement of personal data in a manner equivalent to the GDPR and the Law Enforcement Directive. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — The Law does not apply to processing of personal data by an individual solely for personal, family or household affairs, including recreational purposes (section 4). - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — Part XI of the Law (sections 60-61) establishes and constitutes the Data Protection Authority and sets out its general functions, with Schedule 6 governing the Authority's constitution. - [ODPA (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/2020.09.17-everything-you-need-to-know-about-odpa-registration-and-levy_0.pdf) — Since 2021 the ODPA operates a two-tier annual registration levy: £2,000/year for organisations with 50+ FTE staff and £50/year for all other registering controllers/processors. Charities and not-for-profits must register annually but pay no levy. - [https://legislation.gov.uk/uksi/2023/744/made](https://legislation.gov.uk/uksi/2023/744/made) — Office of the Data Protection Authority (ODPA) — Data Protection (Bailiwick of Guernsey) Law, 2017, s.60 - [https://www.odpa.gg/news/data-protection-authority-adjusts-2026-registration-fees-line-inflation](https://www.odpa.gg/news/data-protection-authority-adjusts-2026-registration-fees-line-inflation) — Office of the Data Protection Authority (ODPA) — £62.22 for under-50-FTE organisations and £2,488.80 for 50+ FTE organisations, from 1 January 2026, adjusted in line with inflation; States of Guernsey pay £259,250 flat, charities pay nothing. ### GG: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core lawful-basis and consent tests confirmed at statute level; full special-category condition list and legitimate-interests balancing-test detail remain unconfirmed gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Schedule 2 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Core lawful-basis and consent tests confirmed at statute level; full special-category condition list and legitimate-interests balancing-test detail remain unconfirmed gaps. D2 · Lawful Processing — Full Module Record 4 sub-modules · 52 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Rights catalogue and several pinpoint sections confirmed; statutory response-deadline figure and portability test detail remain unconfirmed. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Part III Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Rights catalogue and several pinpoint sections confirmed; statutory response-deadline figure and portability test detail remain unconfirmed. #### Sub-modules (5) #### Access RightGreen The Law enumerates rights to information for directly and indirectly collected personal data, a right to data portability, and a right of access. A frivolous/vexatious/excessive-request exception permits refusal or a reasonable administrative fee. Claims (2): - The Law's arrangement of sections enumerates a right to information for personal data collected directly from the data subject, a right to information for indirectly collected personal data, a right to data portability, and a right of access. - Where part of a rights request is frivolous, vexatious, unnecessarily repetitive or otherwise excessive, the controller may refuse that part, or in exceptional circumstances comply but charge a reasonable fee for administrative costs. #### Rectification And ErasureGreen Section 20 gives a right to rectification where a data subject disputes accuracy or completeness. Section 21 gives a right to erasure where, among other grounds, data is no longer necessary, consent is withdrawn, the subject objects, or processing is unlawful. ODPA published DSAR-handling guidance in June 2023. Claims (3): - Section 20 confers a right to rectification where a data subject disputes the accuracy or completeness of their personal data, exercised via a written request to the controller. - Section 21 confers a right to erasure, including on grounds that the data is no longer necessary, consent has been withdrawn, the data subject has objected and the controller must cease processing, or the data has been unlawfully processed. - ODPA's June 2023 guidance sets out a step-by-step process for controllers handling data subject access requests, covering acknowledgement, search, verification and delivery. This is supervisory guidance, not a binding statutory instrument. #### Restriction And ObjectionGreen Section 22 gives a right to restriction of processing where accuracy is disputed, processing is unlawful but erasure is opposed, or data is needed for a legal claim. Section 17 gives an objection right specific to direct-marketing processing, requiring explicit notice before or at first communication. Claims (2): - Section 22 confers a right to restriction of processing where the data subject disputes accuracy pending verification, opposes erasure of unlawfully processed data in favour of restriction, or needs the data retained for a legal claim. - Section 17 applies where personal data is processed for direct marketing purposes and gives the data subject a right to require the controller to cease such processing, with the controller obliged to give notice of this right before or at first communication, explicitly and separately from other matters. #### Data PortabilityAmber A standalone right to data portability is listed in the Law's arrangement of sections; the specific pinpoint provision and scope/test were not isolated from the consolidated text retrieved this pass. #### Deadlines And Response WindowsRed No explicit statutory response-deadline figure (e.g., a one-month equivalent to GDPR Art 12(3)), extension test, or manifestly-unfounded/excessive fee threshold was located in the sources retrieved this pass, beyond the general frivolous/vexatious/excessive exception. The Law confers a GDPR-equivalent suite of data subject rights (information, access, portability, rectification, erasure, restriction, objection, notification of rectification/erasure/restriction, and protection against solely-automated decisions). Pinpoint statutory response-deadline figures (e.g., a one-month analogue to GDPR Art 12(3)) were not located in the sources retrieved this pass. Sources and claims (7) - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — The Law's arrangement of sections enumerates a right to information for personal data collected directly from the data subject, a right to information for indirectly collected personal data, a right to data portability, and a right of access. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — Section 20 confers a right to rectification where a data subject disputes the accuracy or completeness of their personal data, exercised via a written request to the controller. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — Section 21 confers a right to erasure, including on grounds that the data is no longer necessary, consent has been withdrawn, the data subject has objected and the controller must cease processing, or the data has been unlawfully processed. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — Section 22 confers a right to restriction of processing where the data subject disputes accuracy pending verification, opposes erasure of unlawfully processed data in favour of restriction, or needs the data retained for a legal claim. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — Section 17 applies where personal data is processed for direct marketing purposes and gives the data subject a right to require the controller to cease such processing, with the controller obliged to give notice of this right before or at first communication, explicitly and separately from other matters. - [States of Guernsey (mirrored via DataGuidance)](https://www.dataguidance.com/sites/default/files/chttphandler.pdf) — Where part of a rights request is frivolous, vexatious, unnecessarily repetitive or otherwise excessive, the controller may refuse that part, or in exceptional circumstances comply but charge a reasonable fee for administrative costs. - [DataGuidance (news summary)](https://www.dataguidance.com/news/guernsey-odpa-issues-guidance-dsars) — ODPA's June 2023 guidance sets out a step-by-step process for controllers handling data subject access requests, covering acknowledgement, search, verification and delivery. This is supervisory guidance, not a binding statutory instrument. ### GG: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach-notification and principles confirmed at pinpoint level; DPO threshold, ROPA exemption test and joint-controller provisions remain gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Part II and sections 42-43 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Breach-notification and principles confirmed at pinpoint level; DPO threshold, ROPA exemption test and joint-controller provisions remain gaps. D4 · Controller & Processor — Full Module Record 7 sub-modules · 52 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Strong Tier-1 evidentiary base (EU and UK official sources) confirming adequacy status both inbound (received) and the statute's own authorised-jurisdiction mechanism; TIA and localisation sub-modules are genuine gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Part X; EU Commission Decision 2003/821/EC; UK DPA 2018 Schedule 21 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Green Strong Tier-1 evidentiary base (EU and UK official sources) confirming adequacy status both inbound (received) and the statute's own authorised-jurisdiction mechanism; TIA and localisation sub-modules are genuine gaps. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 91 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Only the financial_sector_overlay sub-module has supporting evidence; remaining seven sub-modules are unconfirmed gaps on a non-EU, non-EEA Crown Dependency. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Schedule 8 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Only the financial_sector_overlay sub-module has supporting evidence; remaining seven sub-modules are unconfirmed gaps on a non-EU, non-EEA Crown Dependency. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 45 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Dark-patterns and direct-marketing sub-modules evidenced; cookies/trackers, opt-out signals, clean rooms and cross-context advertising are unconfirmed gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, section 17; ODPA supervisory practice Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Dark-patterns and direct-marketing sub-modules evidenced; cookies/trackers, opt-out signals, clean rooms and cross-context advertising are unconfirmed gaps. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 42 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ ADM right confirmed at statute level and AI guidance confirmed at supervisory level; profiling, biometric, genetic and surveillance-carveout sub-modules are unconfirmed gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, section 24 Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber ADM right confirmed at statute level and AI guidance confirmed at supervisory level; profiling, biometric, genetic and surveillance-carveout sub-modules are unconfirmed gaps. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 36 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### GG: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No sub-module in this area returned a confirmed Guernsey-specific statutory provision from the sources accessible this pass; escalation to the official Guernsey Legal Resources text and/or direct ODPA guidance library is recommended. Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Not assessed No sub-module in this area returned a confirmed Guernsey-specific statutory provision from the sources accessible this pass; escalation to the official Guernsey Legal Resources text and/or direct ODPA guidance library is recommended. #### Sub-modules (5) #### Age VerificationRed No age-of-digital-consent or age-assurance provision was located for Guernsey this pass. #### Parental ConsentRed No parental-consent mechanism provision was located for Guernsey this pass. #### Minor Profiling BansRed No minor-profiling-for-advertising prohibition was located for Guernsey this pass. #### Education SettingsRed No education-settings-specific DP rule was located for Guernsey this pass. #### Dependent AdultsRed No dependent-adults-specific DP protection was located for Guernsey this pass. No Guernsey-specific statutory age-of-digital-consent provision (GDPR Art 8 analogue), minor-self-exercise-of-rights age, age-assurance/children's-design-code instrument, minor-profiling prohibition, education-settings rule, or dependent-adults protection was located in the sources retrieved this research pass. This module is marked as a genuine evidentiary gap rather than a silent omission. ### GG: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement architecture, complaint/court redress routes and recent enforcement activity are confirmed; the specific statutory fine-cap figures and collective-redress mechanisms remain unconfirmed gaps. Primary framework Data Protection (Bailiwick of Guernsey) Law, 2017, Part XII Supervisory authority [Office of the Data Protection Authority (ODPA)](https://odpa.gg/) Traffic-light rationale — Amber Enforcement architecture, complaint/court redress routes and recent enforcement activity are confirmed; the specific statutory fine-cap figures and collective-redress mechanisms remain unconfirmed gaps. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 99 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions