JE

Regulator And AuthorityGreen

JOIC is the operating name of the JDPA, a statutory body under the DPAJL 2018 acting as Jersey's independent regulator for information rights.

Claims (2):

• The JDPA is a statutory body established under the DPAJL 2018 to act as Jersey's independent regulator to uphold information rights in the public interest, promote openness by public bodies and data privacy for individuals; JOIC is its operational name.
• Article 15 of the DPAJL 2018 requires the JDPA to develop international cooperation mechanisms and provide international mutual assistance in enforcement of data-protection legislation, including via notification, complaint referral, investigative assistance and information exchange.

Act And InstrumentsAmber

Twin-statute structure (DPJL 2018 + DPAJL 2018), enacted in 2018 to preserve EU adequacy while diverging from GDPR in several particulars.

Claims (1):

• Jersey introduced two companion statutes in 2018 — the Data Protection (Jersey) Law 2018 and the Data Protection Authority (Jersey) Law 2018 (collectively 'the Jersey Laws') — built on the foundations of prior Jersey data-protection legislation, enacted with the intention of preserving the Island's pre-existing EU adequacy status.

Material ScopeRed

General GDPR-equivalent material scope is assumed by practitioners but the precise statutory definitions were not independently retrieved.

Claims (1):

• The precise statutory definitions of 'personal data' and 'processing' under DPJL 2018 Article 1 were not independently retrieved; practitioner commentary assumes GDPR-equivalent material scope.

Territorial ScopeAmber

Jersey defines establishment and the representative duty differently from GDPR Art 3/27, and Jersey sits outside the scope of the UK's own DPA 2018/adequacy decision.

Claims (2):

• Jersey's data protection laws define 'establishment' differently from the GDPR given Jersey's geographical and legal status, and require appointment of a local representative only where a controller or processor uses equipment in Jersey, a narrower trigger than the GDPR Art 3(2) targeting/monitoring test.
• The UK's Data Protection Act 2018 and the EU's UK-adequacy decision (Commission Implementing Decision (EU) 2021/1772) do not extend to the British Crown Dependencies, meaning Jersey operates a legally separate data-protection regime rather than inheriting the UK's framework or its EU adequacy.

Regulator Registration And FilingAmber

Mandatory controller registration with JOIC is retained, unlike the EU's post-GDPR abolition of general notification; fee schedule unconfirmed.

Claims (1):

• Jersey law retains a mandatory registration requirement with JOIC for controllers, a feature that distinguishes it from the GDPR's abolition of general notification obligations.

Lawful BasesRed

General alignment with GDPR Art 6 architecture asserted by commentary; no pinpoint provision retrieved.

Claims (1):

• Jersey's DPJL 2018 is described by practitioners as 'aligned with GDPR principles' with respect to lawful bases for processing, but the specific enumerated provisions equivalent to GDPR Art 6 were not retrieved from primary legislation in this research pass.

Consent ThresholdsRed

Not located in this pass.

Claims (1):

• Neither the DPJL 2018 consent-validity conditions nor its pseudonymisation/anonymisation identifiability test were located from primary or secondary sources in this research pass.

Special CategoriesAmber

Confirmed via enforcement record that DPJL 2018 Article 8(1)(f) covers special-category/sensitive personal data mishandling.

Claims (1):

• The JDPA's 2021 reprimand of the Children's Services of the Government of Jersey was founded on a contravention of Article 8(1)(f) of the Data Protection (Jersey) Law 2018, arising from unnecessary disclosure of the complainant's 'extremely sensitive special category personal information', confirming DPJL 2018 contains a special-category data concept paralleling GDPR Art 9.

Pseudonymisation And AnonymisationRed

Not located in this pass.

Claims (1):

• Neither the DPJL 2018 consent-validity conditions nor its pseudonymisation/anonymisation identifiability test were located from primary or secondary sources in this research pass.

Access RightAmber

SAR response period confirmed shorter than GDPR's one month; exact figure not retrieved.

Claims (1):

• The statutory response period for subject access requests under Jersey's Data Protection (Jersey) Law 2018 is shorter than the GDPR's one-month standard, per practitioner comparison, though the precise number of days was not confirmed from primary legislation in this pass.

Rectification And ErasureRed

Not located in this pass.

Claims (1):

• No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law.

Restriction And ObjectionRed

Not located in this pass.

Claims (1):

• No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law.

Data PortabilityRed

Not located in this pass.

Claims (1):

• No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law.

Deadlines And Response WindowsAmber

Shorter-than-GDPR SAR deadline confirmed directionally; precise figure outstanding.

Claims (1):

• The statutory response period for subject access requests under Jersey's Data Protection (Jersey) Law 2018 is shorter than the GDPR's one-month standard, per practitioner comparison, though the precise number of days was not confirmed from primary legislation in this pass.

Accountability And DpiaRed

Not located in this pass.

Claims (1):

• No DPIA trigger list, DPO appointment threshold, ROPA exemption test, joint-controller allocation rule, or retention/disposal duty under Jersey law was located from primary or secondary sources in this research pass.

Dpo RequirementsRed

Not located in this pass.

Claims (1):

• No DPIA trigger list, DPO appointment threshold, ROPA exemption test, joint-controller allocation rule, or retention/disposal duty under Jersey law was located from primary or secondary sources in this research pass.

Ropa RequirementsRed

Not located in this pass.

Claims (1):

• No DPIA trigger list, DPO appointment threshold, ROPA exemption test, joint-controller allocation rule, or retention/disposal duty under Jersey law was located from primary or secondary sources in this research pass.

Joint Controller ArrangementsRed

Not located in this pass.

Claims (1):

• No DPIA trigger list, DPO appointment threshold, ROPA exemption test, joint-controller allocation rule, or retention/disposal duty under Jersey law was located from primary or secondary sources in this research pass.

Security MeasuresAmber

Confirmed via 2021 enforcement action referencing the integrity-and-confidentiality principle.

Claims (1):

• The JDPA found that the Children's Services of the Government of Jersey had failed to comply with the 'integrity and confidentiality principle' and to implement 'appropriate technological and organisational measures to ensure the security' of personal data it processes, confirming a GDPR Art 32-equivalent security obligation under DPJL 2018.

Breach NotificationGreen

72-hour breach notification mandatory, mirroring GDPR Art 33.

Claims (1):

• Personal data breach reporting under Jersey's Data Protection (Jersey) Law 2018 is mandatory within 72 hours, mirroring the GDPR Art 33 standard (this is the data-protection breach rule only; ICT-incident regimes are out of scope here).

Retention And DisposalRed

Not located in this pass.

Claims (1):

• No DPIA trigger list, DPO appointment threshold, ROPA exemption test, joint-controller allocation rule, or retention/disposal duty under Jersey law was located from primary or secondary sources in this research pass.

Transfer MechanismsAmber

Jersey law is said to impose its own distinct international transfer requirements; precise gateways not retrieved.

Claims (1):

• Jersey's data protection law is described by practitioners as imposing 'specific international data transfer requirements' distinct from the GDPR's Chapter V mechanism, though the precise statutory transfer gateways were not independently retrieved from primary legislation.

Adequacy ReceivedGreen

Jersey adequacy from the EU (2008, reconfirmed 2024) and from the UK (general and law-enforcement) is confirmed; Jersey is excluded from the EU-UK decision's own scope.

Claims (5):

• Commission Decision 2008/393/EC of 8 May 2008, adopted pursuant to Article 25(6) of Directive 95/46/EC, found that 'the Bailiwick of Jersey is considered as providing an adequate level of protection for personal data transferred from the Community'.
• The Commission's first periodic review of adequacy decisions adopted under the former Data Protection Directive concluded that Jersey (together with ten other adequacy partners) 'continues to ensure an adequate level of protection for personal data transferred from the European Union', based on an assessment that included government-access rules for law enforcement and national security purposes.
• The Bailiwick of Jersey is already recognised as adequate for personal data transferred under the UK General Data Protection Regulation, per paragraph 5(2)(f) of Schedule 21 to the UK Data Protection Act 2018 — a finding separate from, and not dependent upon, the EU's own adequacy decision.
• The UK Home Office separately assessed and confirmed Jersey's adequacy for law-enforcement-purpose data transfers against the criteria in section 74A of the UK DPA 2018, with the UK Information Commissioner agreeing it was reasonable for the Secretary of State to conclude Jersey provides an adequate level of protection; the UK regime requires review of this finding every four years from the date the regulations come into force.
• Article 97 of the GDPR requires the European Commission to conduct periodic reviews of existing third-country adequacy decisions, including Jersey's, every four years; Jersey's first such review was completed via the Commission's report accompanying COM(2024)7.

Adequacy GrantedRed

No evidence located that Jersey itself has granted outbound adequacy findings to other territories.

Sccs And BcrsRed

Not located in this pass.

Claims (1):

• No SCC/BCR-equivalent instrument, transfer impact assessment requirement, or data-localisation mandate under Jersey law was located in this research pass.

Transfer Impact AssessmentRed

Not located in this pass.

Claims (1):

• No SCC/BCR-equivalent instrument, transfer impact assessment requirement, or data-localisation mandate under Jersey law was located in this research pass.

Data LocalisationRed

Not located in this pass.

Claims (1):

• No SCC/BCR-equivalent instrument, transfer impact assessment requirement, or data-localisation mandate under Jersey law was located in this research pass.

Financial Sector OverlayRed

Not located in this pass despite Jersey's finance-centre status.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

Health Sector OverlayRed

Not located in this pass.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

Telecoms And EprivacyRed

Not located in this pass.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

Employment DataRed

Not located in this pass.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

Credit And ScoringAmber

Confirmed 2026 Population-Register/credit-reference-agency data-sharing initiative.

Claims (1):

• Following a States Assembly legislative amendment passed in January 2026, the Government of Jersey will, from the end of July 2026, share residents' basic personal details from the Population Register with UK credit reference agencies to improve access to credit, mortgages and loans, subject to an opt-out and to Government of Jersey compliance with data protection principles and robust data-sharing agreements overseen by JOIC.

EducationRed

Not located in this pass.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

InsuranceRed

Not located in this pass.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

Data Access SharingRed

No EU-Data-Act-equivalent local smart-data or data-portability scheme identified; the EU Data Act itself does not apply to Jersey as a non-EU/EEA jurisdiction.

Claims (1):

• No Jersey-specific financial-sector data-protection overlay, telecoms/ePrivacy transposition, employment-data code, EU-Data-Act-equivalent smart-data scheme, or health/education/insurance sector-specific DP overlay was located in this research pass.

Cookies And TrackersRed

No Jersey-specific cookie/ePrivacy instrument located; UK PECR confirmed not to extend to Jersey.

Claims (1):

• Because the UK DPA 2018 and the EU-UK adequacy decision do not apply to the British Crown Dependencies including Jersey, the UK's PECR (the UK's ePrivacy/cookie and electronic-marketing instrument) cannot be assumed to govern Jersey; no distinct Jersey cookie or electronic-marketing instrument was located in this research pass.

Dark PatternsRed

Not located in this pass.

Claims (1):

• No Jersey-specific dark-pattern prohibition, opt-out-signal regime, clean-room rule, or cross-context-advertising rule was located in this research pass.

Opt Out SignalsRed

Not located in this pass.

Claims (1):

• No Jersey-specific dark-pattern prohibition, opt-out-signal regime, clean-room rule, or cross-context-advertising rule was located in this research pass.

Clean Rooms And DcrRed

Not located in this pass.

Claims (1):

• No Jersey-specific dark-pattern prohibition, opt-out-signal regime, clean-room rule, or cross-context-advertising rule was located in this research pass.

Cross Context AdvertisingRed

Not located in this pass.

Claims (1):

• No Jersey-specific dark-pattern prohibition, opt-out-signal regime, clean-room rule, or cross-context-advertising rule was located in this research pass.

Direct MarketingRed

No Jersey-specific electronic-marketing consent rule located.

Claims (1):

• Because the UK DPA 2018 and the EU-UK adequacy decision do not apply to the British Crown Dependencies including Jersey, the UK's PECR (the UK's ePrivacy/cookie and electronic-marketing instrument) cannot be assumed to govern Jersey; no distinct Jersey cookie or electronic-marketing instrument was located in this research pass.

Profiling RestrictionsRed

Not located in this pass.

Claims (1):

• No Jersey-specific ADM/profiling rule equivalent to GDPR Art 22, AI Act interface, biometric-specific condition, genetic-data regime, or state-surveillance carve-out was located in this research pass; Jersey is outside the EU and not directly bound by the EU AI Act.

Automated Decision Making TransparencyRed

Not located in this pass.

Claims (1):

• No Jersey-specific ADM/profiling rule equivalent to GDPR Art 22, AI Act interface, biometric-specific condition, genetic-data regime, or state-surveillance carve-out was located in this research pass; Jersey is outside the EU and not directly bound by the EU AI Act.

Ai Risk AssessmentsRed

Jersey is outside the EU AI Act's territorial scope and no local equivalent was located.

Claims (1):

• No Jersey-specific ADM/profiling rule equivalent to GDPR Art 22, AI Act interface, biometric-specific condition, genetic-data regime, or state-surveillance carve-out was located in this research pass; Jersey is outside the EU and not directly bound by the EU AI Act.

Biometric RegimeRed

Not located in this pass.

Claims (1):

• No Jersey-specific ADM/profiling rule equivalent to GDPR Art 22, AI Act interface, biometric-specific condition, genetic-data regime, or state-surveillance carve-out was located in this research pass; Jersey is outside the EU and not directly bound by the EU AI Act.

Genetic DataRed

Not located in this pass.

Claims (1):

• No Jersey-specific ADM/profiling rule equivalent to GDPR Art 22, AI Act interface, biometric-specific condition, genetic-data regime, or state-surveillance carve-out was located in this research pass; Jersey is outside the EU and not directly bound by the EU AI Act.

State Surveillance CarveoutsRed

Not located in this pass.

Claims (1):

• No Jersey-specific ADM/profiling rule equivalent to GDPR Art 22, AI Act interface, biometric-specific condition, genetic-data regime, or state-surveillance carve-out was located in this research pass; Jersey is outside the EU and not directly bound by the EU AI Act.

Age VerificationRed

Not located in this pass.

Claims (1):

• No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection was located from primary or secondary sources in this research pass.

Parental ConsentRed

Not located in this pass.

Claims (1):

• No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection was located from primary or secondary sources in this research pass.

Minor Profiling BansRed

Not located in this pass.

Claims (1):

• No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection was located from primary or secondary sources in this research pass.

Education SettingsRed

Not located in this pass.

Claims (1):

• No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection was located from primary or secondary sources in this research pass.

Dependent AdultsRed

Not located in this pass.

Claims (1):

• No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection was located from primary or secondary sources in this research pass.

Regulator Powers And PenaltiesAmber

Broad enforcement toolkit confirmed including Article 26 penalty notices; public-authority fine exemption confirmed; maximum quantum not located.

Claims (2):

• Part 4 of the DPAJL 2018 places a broad range of statutory duties on the JDPA including monitoring and enforcement of the DPJL 2018, and the JDPA's regulatory and enforcement powers include issuing information notices, enforcement notices, warnings, reprimands, practice recommendations and other orders, and administering fines by way of penalty notices in the circumstances set out in Article 26 of the DPAJL 2018.
• Public authorities in Jersey are shielded from monetary fines under the Authority Law: in its first public enforcement action the JDPA stated it 'would have likely considered' fining the Children's Services of the Government of Jersey 'had it not been prevented by the Authority Law from imposing a fine due to the Children's Services being a public authority'.

Enforcement Activity IndexAmber

2021 Children's Services reprimand and 2026 joint Prospect Custodian Trustees investigation are the two concrete enforcement data points located.

Claims (2):

• On 21 October 2021 the JDPA issued its first public reprimand, against the Children's Services of the Government of Jersey, for contravening Article 8(1)(f) of the DPJL 2018 by disclosing a complainant's special-category data unnecessarily to a family member, with accompanying orders for staff education under Article 25(3) of the Authority Law.
• JOIC is participating in a joint investigation alongside the UK ICO, Guernsey's data protection authority and the Isle of Man Information Commissioner into a data breach at Prospect Custodian Trustees Ltd affecting over 160,000 members, evidencing active cross-Crown-Dependency enforcement cooperation.

Regulator Funding And CapacityRed

Not located in this pass.

Claims (1):

• No information on JOIC/JDPA funding or headcount, nor on any collective-redress, class-action or standalone private-right-of-action mechanism for Jersey data subjects, was located in this research pass.

Collective Redress And Class ActionsRed

Not located in this pass.

Claims (1):

• No information on JOIC/JDPA funding or headcount, nor on any collective-redress, class-action or standalone private-right-of-action mechanism for Jersey data subjects, was located in this research pass.

Private Right Of ActionRed

Not located in this pass.

Claims (1):

• No information on JOIC/JDPA funding or headcount, nor on any collective-redress, class-action or standalone private-right-of-action mechanism for Jersey data subjects, was located in this research pass.

Recent Developments 180DAmber

Joint Prospect Custodian Trustees breach investigation and July 2026 JOIC CRA data-sharing statement are the two 180-day developments located.

Claims (2):

• JOIC is participating in a joint investigation alongside the UK ICO, Guernsey's data protection authority and the Isle of Man Information Commissioner into a data breach at Prospect Custodian Trustees Ltd affecting over 160,000 members, evidencing active cross-Crown-Dependency enforcement cooperation.
• On 3 July 2026 the Jersey Information Commissioner issued a public statement on the Population-Register/credit-reference-agency data-sharing initiative, confirming residents should first lodge complaints with the Government of Jersey and escalate to JOIC if unsatisfied.