JE#
Core regulator identity, statutory basis and the UK/EU non-extension point are well evidenced at T1/T2; material-scope definitions and exact registration fee schedule were not retrieved from primary legislation in this pass.
Sub-modules (5)
Regulator And AuthorityGreen
JOIC is the operating name of the JDPA, a statutory body under the DPAJL 2018 acting as Jersey's independent regulator for information rights.
Claims (4):
- The JDPA is a statutory body established under the DPAJL 2018 to act as Jersey's independent regulator to uphold information rights in the public interest, promote openness by public bodies and data privacy for individuals; JOIC is its operational name.
- Article 15 of the DPAJL 2018 requires the JDPA to develop international cooperation mechanisms and provide international mutual assistance in enforcement of data-protection legislation, including via notification, complaint referral, investigative assistance and information exchange.
- Jersey Information Commissioner (Paul Vane) — The JOIC's 2026-2028 Strategic Plan on 2 February 2026, built on three priorities (Children's Privacy, AI in HR, Cyber Security) and an Advise/Assess/Act enforcement model, stating enforcement action will be taken without delay for clear non-compliance.
- Jersey Data Protection Authority — The Authority's functions are delegated to the Information Commissioner save for the issuing of a formal public statement or an administrative fine, which remain Authority-level decisions.
Act And InstrumentsAmber
Twin-statute structure (DPJL 2018 + DPAJL 2018), enacted in 2018 to preserve EU adequacy while diverging from GDPR in several particulars.
Claims (1):
- Jersey introduced two companion statutes in 2018 — the Data Protection (Jersey) Law 2018 and the Data Protection Authority (Jersey) Law 2018 (collectively 'the Jersey Laws') — built on the foundations of prior Jersey data-protection legislation, enacted with the intention of preserving the Island's pre-existing EU adequacy status.
Material ScopeRed
General GDPR-equivalent material scope is assumed by practitioners but the precise statutory definitions were not independently retrieved.
Claims (1):
- The precise statutory definitions of 'personal data' and 'processing' under DPJL 2018 Article 1 were not independently retrieved; practitioner commentary assumes GDPR-equivalent material scope.
Territorial ScopeAmber
Jersey defines establishment and the representative duty differently from GDPR Art 3/27, and Jersey sits outside the scope of the UK's own DPA 2018/adequacy decision.
Claims (2):
- Jersey's data protection laws define 'establishment' differently from the GDPR given Jersey's geographical and legal status, and require appointment of a local representative only where a controller or processor uses equipment in Jersey, a narrower trigger than the GDPR Art 3(2) targeting/monitoring test.
- The UK's Data Protection Act 2018 and the EU's UK-adequacy decision (Commission Implementing Decision (EU) 2021/1772) do not extend to the British Crown Dependencies, meaning Jersey operates a legally separate data-protection regime rather than inheriting the UK's framework or its EU adequacy.
Regulator Registration And FilingAmber
Mandatory controller registration with JOIC is retained, unlike the EU's post-GDPR abolition of general notification; fee schedule unconfirmed.
Claims (2):
- Jersey law retains a mandatory registration requirement with JOIC for controllers, a feature that distinguishes it from the GDPR's abolition of general notification obligations.
- Jersey Data Protection Authority — All data controllers processing personal data in Jersey must register annually with the JDPA; 2026 renewal window ran 1 January-28 February 2026; a revised registration fee model was under consultation December 2025-February 2026.
Regulator & Framework
The Jersey Office of the Information Commissioner, under Commissioner Paul Vane, launched its 2026-2028 Strategic Plan on 2 February 2026. The plan is built around three named priorities — Children's Privacy, Artificial Intelligence in HR decision-making, and Cyber Security — and is delivered through an Advise, Assess, Act operating model. Commissioner Vane's own framing of the plan was explicit about enforcement intent: the Commission stated that the underlying Data Protection (Jersey) Law has been in force for years and that enforcement action will be taken without delay where clear non-compliance is identified, framing continued non-compliance as a choice to leave an organisation exposed to enforcement rather than as an oversight the regulator will continue to tolerate.
This is a structural statement about supervisory posture rather than a change to the substantive law. The Data Protection (Jersey) Law 2018 itself is unchanged; what the Strategic Plan does is commit the regulator publicly to a faster and more assertive enforcement cadence than organisations may have experienced in prior years. The three named priorities also indicate where that assertive posture will be concentrated: children's privacy, AI used in employment contexts, and cybersecurity assessment, rather than being spread evenly across the full range of data-protection obligations.
On the administrative side of the regulator-and-framework picture, Jersey's annual registration requirement continued to operate on its normal cycle. All data controllers processing personal data in Jersey must register annually with the Jersey Data Protection Authority, and the 2026 renewal window ran from 1 January to 28 February 2026. A revised registration fee model, covering both public and private sector registrants, was put out for consultation from December 2025 to February 2026. The outcome of that consultation — whether a revised fee schedule was in fact adopted, and on what terms — has not been identified in the material available, leaving the final shape of the 2026 fee model an open question for registrants budgeting for the next renewal cycle.
Taken together, the Strategic Plan launch and the registration-fee consultation describe a regulator simultaneously sharpening its enforcement posture and reviewing its own administrative funding model, two developments that often move together: a regulator signalling more assertive enforcement activity also has reason to review whether its registration-fee income is adequate to support that activity.
Outlook
The practical test of the 2026-2028 Strategic Plan's Advise, Assess, Act model will be whether the enforcement tempo evidenced through mid-2026 is sustained over the plan's full three-year horizon. The outcome of the registration fee-model consultation remains unresolved as and should be tracked for whether a revised fee schedule is formally adopted.
Sources and claims (10)
- Confirmed ICO / JOIC — The JDPA is a statutory body established under the DPAJL 2018 to act as Jersey's independent regulator to uphold information rights in the public interest, promote openness by public bodies and data privacy for individuals; JOIC is its operational name. observed
- Probable DataGuidance — Jersey introduced two companion statutes in 2018 — the Data Protection (Jersey) Law 2018 and the Data Protection Authority (Jersey) Law 2018 (collectively 'the Jersey Laws') — built on the foundations of prior Jersey data-protection legislation, enacted with the intention of preserving the Island's pre-existing EU adequacy status. observed
- Probable DataGuidance — Jersey's data protection laws define 'establishment' differently from the GDPR given Jersey's geographical and legal status, and require appointment of a local representative only where a controller or processor uses equipment in Jersey, a narrower trigger than the GDPR Art 3(2) targeting/monitoring test. observed
- Probable DataGuidance — Jersey law retains a mandatory registration requirement with JOIC for controllers, a feature that distinguishes it from the GDPR's abolition of general notification obligations. observed
- Uncertain DataGuidance — The precise statutory definitions of 'personal data' and 'processing' under DPJL 2018 Article 1 were not independently retrieved; practitioner commentary assumes GDPR-equivalent material scope. observed
- Confirmed EUR-Lex — The UK's Data Protection Act 2018 and the EU's UK-adequacy decision (Commission Implementing Decision (EU) 2021/1772) do not extend to the British Crown Dependencies, meaning Jersey operates a legally separate data-protection regime rather than inheriting the UK's framework or its EU adequacy. observed
- Confirmed ICO / JOIC — Article 15 of the DPAJL 2018 requires the JDPA to develop international cooperation mechanisms and provide international mutual assistance in enforcement of data-protection legislation, including via notification, complaint referral, investigative assistance and information exchange. observed
- Confirmed https://jerseyoic.org/news/the-ink-dried-on-data-protection-law-years-ago-if-you-re-not-compliant-you-re-leaving-yourself-open-to-enforcement-action — Jersey Information Commissioner (Paul Vane) — The JOIC's 2026-2028 Strategic Plan on 2 February 2026, built on three priorities (Children's Privacy, AI in HR, Cyber Security) and an Advise/Assess/Act enforcement model, stating enforcement action will be taken without delay for clear non-compliance.
- Probable https://jerseychamber.com/news/data-protection-registration-renewal-now-open-2026 — Jersey Data Protection Authority — All data controllers processing personal data in Jersey must register annually with the JDPA; 2026 renewal window ran 1 January-28 February 2026; a revised registration fee model was under consultation December 2025-February 2026.
- Probable DLA Piper Data Protection Laws of the World — Jersey Data Protection Authority — The Authority's functions are delegated to the Information Commissioner save for the issuing of a formal public statement or an administrative fine, which remain Authority-level decisions. observed