--- title: "JE Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/je-data-protection-privacy-regulation/ source_html: /jurisdictions/jersey/index.html description: "JE data protection and privacy regulation: 10 categories, 51 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 242a6b846e51ad82971471de9f2f0a6839b5b53c1caa7cc770b27c5388e4aeca generator: "fe-fleet/md-twin@1.0" --- # JE Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/jersey/), [World Payments](https://payments.gi/jurisdictions/jersey/) Last updated 2026-10-25 · 10 categories · 51 claims · 22 sources in the cumulative register Download report (PDF) Expand all The Jersey Office of the Information Commissioner launched its 2026-2028 Strategic Plan on 2 February 2026, built around three priorities — Children's Privacy, AI in HR, and Cyber Security — delivered through an Advise, Assess, Act enforcement model under which Commissioner Paul Vane stated that enforcement action will be taken without delay for clear non-compliance. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Data Subject Rights, Cross-Border & Adequacy, Algorithmic, Biometric & Surveillance Governance (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=JERSEY)[Build Report](/reports/?j=JERSEY)[Compare](/compare/?j=JERSEY) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Jersey Office of the Information Commissioner (JOIC) / Jersey Data Protection Authori Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 4 Red categories 58 Sub-modules 51 Claims 4 Tier-1 sources Traffic-light mix 5 amber 4 red 1 green (sums to 10 rendered categories; click to filter) 4 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 838 Full executive summary 175 ###### Latest update · 25 October 2026 #### Lead Signal The Jersey Office of the Information Commissioner launched its 2026-2028 Strategic Plan on 2 February 2026, built around three priorities — Children's Privacy, AI in HR, and Cyber Security — delivered through an Advise, Assess, Act enforcement model under which Commissioner Paul Vane stated that enforcement action will be taken without delay for clear non-compliance. The underlying Data Protection (Jersey) Law 2018 itself has not changed; what has changed is the supervisory posture applied to it, and that shift is corroborated by concrete enforcement activity: the JOIC issued decision notices against Infrastructure and Environment (25 June 2026), the Department for the Economy (13 May and 25 June 2026), and the Judicial Greffe (15 June 2026). This combination — a published strategic plan naming swifter enforcement as a delivery model, followed within months by multiple decision notices against government departments — is the kind of structural signal that matters more than any single enforcement action in isolation. It indicates the JOIC is translating its stated intent into practice rather than issuing aspirational guidance that remains unimplemented. #### Other Developments Annual registration renewal proceeded on schedule with a fee-model question still open. All data controllers processing personal data in Jersey are required to register annually with the Jersey Data Protection Authority; the 2026 renewal window ran from 1 January to 28 February 2026. A revised registration-fee model was under consultation from December 2025 to February 2026, but the outcome of that consultation, including any final fee schedule, has not been identified as. #### Cross-Monitor Connections The JOIC's named strategic priority on AI in HR decision-making, and the operation of the Obliged Entity Beneficial Owner register under the Financial Services (Disclosure and Provision of Information) (Jersey) Law 2020 as amended, both connect to the Financial Integrity Monitor's coverage of Jersey. Access to beneficial-owner personal data via the OEBO register has, since 24 February 2025, been restricted to customer due diligence purposes, with misuse carrying criminal liability — a data-protection-adjacent control sitting alongside, and reinforcing, the AML/CTF framework financial-integrity coverage tracks for Jersey. #### Outlook The JOIC's enforcement posture, as signalled by its 2026-2028 Strategic Plan and evidenced by decision notices issued through mid-2026, should be expected to continue at a similar or increased pace as the plan's Advise, Assess, Act model matures. The outcome of the registration fee-model consultation, launched December 2025 and closed February 2026, remains an open question pending identification of a published decision. ###### Standing brief · as of 11 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal #### Other Developments Annual registration renewal proceeded on schedule with a fee-model question still open. All data controllers processing personal data in Jersey are required to register annually with the Jersey Data Protection Authority; the 2026 renewal window ran from 1 January to 28 February 2026. A revised registration-fee model was under consultation from December 2025 to February 2026, but the outcome of that consultation, including any final fee schedule, has not been identified as at this cycle. #### Cross-Monitor Connections The JOIC's named strategic priority on AI in HR decision-making, and the operation of the Obliged Entity Beneficial Owner register under the Financial Services (Disclosure and Provision of Information) (Jersey) Law 2020 as amended, both connect to the Financial Integrity Monitor's coverage of Jersey this cycle. Access to beneficial-owner personal data via the OEBO register has, since 24 February 2025, been restricted to customer due diligence purposes, with misuse carrying criminal liability — a data-protection-adjacent control sitting alongside, and reinforcing, the AML/CTF framework financial-integrity coverage tracks for Jersey. #### Outlook Read full brief · 838 words Standing brief, as of 11 October 2026. #### Regulatory Status Jersey's data-protection regulator, the Jersey Office of the Information Commissioner, launched its 2026-2028 Strategic Plan on 2 February 2026, naming Children's Privacy, AI in HR, and Cyber Security as its three delivery priorities under an Advise, Assess, Act enforcement model, with Commissioner Paul Vane stating enforcement action will be taken without delay for clear non-compliance. That assertive posture is already evidenced in practice: the JOIC issued decision notices against three government departments between May and June 2026 — Department for the Economy (13 May and 25 June), the Judicial Greffe (15 June), and Infrastructure and Environment (25 June). The underlying Data Protection (Jersey) Law 2018 is unchanged. Separately, Jersey's annual data-controller registration renewal ran its normal 1 January to 28 February 2026 cycle, with a registration fee-model consultation (December 2025-February 2026) whose outcome remains unidentified. #### Outlook The JOIC's enforcement tempo, evidenced through mid-2026, is the key marker to track over the remainder of the 2026-2028 Strategic Plan period, alongside resolution of the registration fee-model consultation outcome. Read full brief · 175 words Key regulatory facts for JE Regulatory Dimension JE Standing Position Jurisdiction JE (JE) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 51 sourced findings) Regulator & Framework Core regulator identity, statutory basis and the UK/EU non-extension point are well evidenced at T1/T2; material-scope definitions and exact registration fee schedule were not retrieved from primary legislation in... Lawful Processing & Special Data No primary-instrument pinpoint located for lawful bases, consent thresholds or pseudonymisation tests; only one enforcement-derived special-category reference confirmed. Data Subject Rights One confirmed directional finding (shorter SAR window) at T3 confidence; remaining sub-modules unpopulated. Controller/Processor Duties Breach notification and security principle well evidenced; five of seven sub-modules unpopulated. Primary Instruments Cited ICO / JOIC, DataGuidance, EUR-Lex, JE Official Instrument (jerseyoic.org the-ink-dried-on-data-protection), JE Official Instrument (jerseychamber.com data-protection-registration-ren) Last Confirmed / Updated 2026-10-25 (22 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### JE: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core regulator identity, statutory basis and the UK/EU non-extension point are well evidenced at T1/T2; material-scope definitions and exact registration fee schedule were not retrieved from primary legislation in this pass. Primary framework Data Protection (Jersey) Law 2018 / Data Protection Authority (Jersey) Law 2018 Supervisory authority [Jersey Office of the Information Commissioner (JOIC) / Jersey Data Protection Authority (JDPA)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Amber Core regulator identity, statutory basis and the UK/EU non-extension point are well evidenced at T1/T2; material-scope definitions and exact registration fee schedule were not retrieved from primary legislation in this pass. #### Sub-modules (5) #### Regulator And AuthorityGreen JOIC is the operating name of the JDPA, a statutory body under the DPAJL 2018 acting as Jersey's independent regulator for information rights. Claims (4): - The JDPA is a statutory body established under the DPAJL 2018 to act as Jersey's independent regulator to uphold information rights in the public interest, promote openness by public bodies and data privacy for individuals; JOIC is its operational name. - Article 15 of the DPAJL 2018 requires the JDPA to develop international cooperation mechanisms and provide international mutual assistance in enforcement of data-protection legislation, including via notification, complaint referral, investigative assistance and information exchange. - Jersey Information Commissioner (Paul Vane) — The JOIC's 2026-2028 Strategic Plan on 2 February 2026, built on three priorities (Children's Privacy, AI in HR, Cyber Security) and an Advise/Assess/Act enforcement model, stating enforcement action will be taken without delay for clear non-compliance. - Jersey Data Protection Authority — The Authority's functions are delegated to the Information Commissioner save for the issuing of a formal public statement or an administrative fine, which remain Authority-level decisions. #### Act And InstrumentsAmber Twin-statute structure (DPJL 2018 + DPAJL 2018), enacted in 2018 to preserve EU adequacy while diverging from GDPR in several particulars. Claims (1): - Jersey introduced two companion statutes in 2018 — the Data Protection (Jersey) Law 2018 and the Data Protection Authority (Jersey) Law 2018 (collectively 'the Jersey Laws') — built on the foundations of prior Jersey data-protection legislation, enacted with the intention of preserving the Island's pre-existing EU adequacy status. #### Material ScopeRed General GDPR-equivalent material scope is assumed by practitioners but the precise statutory definitions were not independently retrieved. Claims (1): - The precise statutory definitions of 'personal data' and 'processing' under DPJL 2018 Article 1 were not independently retrieved; practitioner commentary assumes GDPR-equivalent material scope. #### Territorial ScopeAmber Jersey defines establishment and the representative duty differently from GDPR Art 3/27, and Jersey sits outside the scope of the UK's own DPA 2018/adequacy decision. Claims (2): - Jersey's data protection laws define 'establishment' differently from the GDPR given Jersey's geographical and legal status, and require appointment of a local representative only where a controller or processor uses equipment in Jersey, a narrower trigger than the GDPR Art 3(2) targeting/monitoring test. - The UK's Data Protection Act 2018 and the EU's UK-adequacy decision (Commission Implementing Decision (EU) 2021/1772) do not extend to the British Crown Dependencies, meaning Jersey operates a legally separate data-protection regime rather than inheriting the UK's framework or its EU adequacy. #### Regulator Registration And FilingAmber Mandatory controller registration with JOIC is retained, unlike the EU's post-GDPR abolition of general notification; fee schedule unconfirmed. Claims (2): - Jersey law retains a mandatory registration requirement with JOIC for controllers, a feature that distinguishes it from the GDPR's abolition of general notification obligations. - Jersey Data Protection Authority — All data controllers processing personal data in Jersey must register annually with the JDPA; 2026 renewal window ran 1 January-28 February 2026; a revised registration fee model was under consultation December 2025-February 2026. Jersey operates a GDPR-aligned omnibus regime built on two companion statutes: the Data Protection (Jersey) Law 2018 (DPJL 2018), the substantive code, and the Data Protection Authority (Jersey) Law 2018 (DPAJL 2018), which establishes the Jersey Data Protection Authority (JDPA), operating under the public-facing name the Jersey Office of the Information Commissioner (JOIC). Jersey is a Crown Dependency, not part of the UK or EU, and is not directly bound by either the EU GDPR or the UK GDPR/DPA 2018 — the UK's own adequacy decision and DPA 2018 expressly do not extend to the Bailiwick. Jersey's territorial-scope test (establishment, representative duty keyed to use of equipment in Jersey) and its retained controller-registration duty diverge from the post-2018 EU/UK approach. Periodic update · new data 2026-10-25 #### Regulator & Framework The Jersey Office of the Information Commissioner, under Commissioner Paul Vane, launched its 2026-2028 Strategic Plan on 2 February 2026. The plan is built around three named priorities — Children's Privacy, Artificial Intelligence in HR decision-making, and Cyber Security — and is delivered through an Advise, Assess, Act operating model. Commissioner Vane's own framing of the plan was explicit about enforcement intent: the Commission stated that the underlying Data Protection (Jersey) Law has been in force for years and that enforcement action will be taken without delay where clear non-compliance is identified, framing continued non-compliance as a choice to leave an organisation exposed to enforcement rather than as an oversight the regulator will continue to tolerate. This is a structural statement about supervisory posture rather than a change to the substantive law. The Data Protection (Jersey) Law 2018 itself is unchanged; what the Strategic Plan does is commit the regulator publicly to a faster and more assertive enforcement cadence than organisations may have experienced in prior years. The three named priorities also indicate where that assertive posture will be concentrated: children's privacy, AI used in employment contexts, and cybersecurity assessment, rather than being spread evenly across the full range of data-protection obligations. On the administrative side of the regulator-and-framework picture, Jersey's annual registration requirement continued to operate on its normal cycle. All data controllers processing personal data in Jersey must register annually with the Jersey Data Protection Authority, and the 2026 renewal window ran from 1 January to 28 February 2026. A revised registration fee model, covering both public and private sector registrants, was put out for consultation from December 2025 to February 2026. The outcome of that consultation — whether a revised fee schedule was in fact adopted, and on what terms — has not been identified in the material available, leaving the final shape of the 2026 fee model an open question for registrants budgeting for the next renewal cycle. Taken together, the Strategic Plan launch and the registration-fee consultation describe a regulator simultaneously sharpening its enforcement posture and reviewing its own administrative funding model, two developments that often move together: a regulator signalling more assertive enforcement activity also has reason to review whether its registration-fee income is adequate to support that activity. #### Outlook The practical test of the 2026-2028 Strategic Plan's Advise, Assess, Act model will be whether the enforcement tempo evidenced through mid-2026 is sustained over the plan's full three-year horizon. The outcome of the registration fee-model consultation remains unresolved as and should be tracked for whether a revised fee schedule is formally adopted. Sources and claims (10) - [ICO / JOIC](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) — The JDPA is a statutory body established under the DPAJL 2018 to act as Jersey's independent regulator to uphold information rights in the public interest, promote openness by public bodies and data privacy for individuals; JOIC is its operational name. - [DataGuidance](https://www.dataguidance.com/opinion/jersey-comparison-between-gdpr-and-jersey-data) — Jersey introduced two companion statutes in 2018 — the Data Protection (Jersey) Law 2018 and the Data Protection Authority (Jersey) Law 2018 (collectively 'the Jersey Laws') — built on the foundations of prior Jersey data-protection legislation, enacted with the intention of preserving the Island's pre-existing EU adequacy status. - [DataGuidance](https://www.dataguidance.com/opinion/jersey-comparison-between-gdpr-and-jersey-data) — Jersey's data protection laws define 'establishment' differently from the GDPR given Jersey's geographical and legal status, and require appointment of a local representative only where a controller or processor uses equipment in Jersey, a narrower trigger than the GDPR Art 3(2) targeting/monitoring test. - [DataGuidance](https://www.dataguidance.com/opinion/jersey-comparison-between-gdpr-and-jersey-data) — Jersey law retains a mandatory registration requirement with JOIC for controllers, a feature that distinguishes it from the GDPR's abolition of general notification obligations. - [DataGuidance](https://www.dataguidance.com/opinion/jersey-comparison-between-gdpr-and-jersey-data) — The precise statutory definitions of 'personal data' and 'processing' under DPJL 2018 Article 1 were not independently retrieved; practitioner commentary assumes GDPR-equivalent material scope. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/DA/TXT/PDF/?uri=CELEX%3A32021D1772&from=EN) — The UK's Data Protection Act 2018 and the EU's UK-adequacy decision (Commission Implementing Decision (EU) 2021/1772) do not extend to the British Crown Dependencies, meaning Jersey operates a legally separate data-protection regime rather than inheriting the UK's framework or its EU adequacy. - [ICO / JOIC](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) — Article 15 of the DPAJL 2018 requires the JDPA to develop international cooperation mechanisms and provide international mutual assistance in enforcement of data-protection legislation, including via notification, complaint referral, investigative assistance and information exchange. - [https://jerseyoic.org/news/the-ink-dried-on-data-protection-law-years-ago-if-you-re-not-compliant-you-re-leaving-yourself-open-to-enforcement-action](https://jerseyoic.org/news/the-ink-dried-on-data-protection-law-years-ago-if-you-re-not-compliant-you-re-leaving-yourself-open-to-enforcement-action) — Jersey Information Commissioner (Paul Vane) — The JOIC's 2026-2028 Strategic Plan on 2 February 2026, built on three priorities (Children's Privacy, AI in HR, Cyber Security) and an Advise/Assess/Act enforcement model, stating enforcement action will be taken without delay for clear non-compliance. - [https://jerseychamber.com/news/data-protection-registration-renewal-now-open-2026](https://jerseychamber.com/news/data-protection-registration-renewal-now-open-2026) — Jersey Data Protection Authority — All data controllers processing personal data in Jersey must register annually with the JDPA; 2026 renewal window ran 1 January-28 February 2026; a revised registration fee model was under consultation December 2025-February 2026. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=enforcement&c=JE&c2=GB) — Jersey Data Protection Authority — The Authority's functions are delegated to the Information Commissioner save for the issuing of a formal public statement or an administrative fine, which remain Authority-level decisions. ### JE: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No primary-instrument pinpoint located for lawful bases, consent thresholds or pseudonymisation tests; only one enforcement-derived special-category reference confirmed. Primary framework Data Protection (Jersey) Law 2018 Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Red No primary-instrument pinpoint located for lawful bases, consent thresholds or pseudonymisation tests; only one enforcement-derived special-category reference confirmed. D2 · Lawful Processing — Full Module Record 4 sub-modules · 65 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ One confirmed directional finding (shorter SAR window) at T3 confidence; remaining sub-modules unpopulated. Primary framework Data Protection (Jersey) Law 2018 Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Amber One confirmed directional finding (shorter SAR window) at T3 confidence; remaining sub-modules unpopulated. #### Sub-modules (5) #### Access RightAmber SAR response period confirmed shorter than GDPR's one month; exact figure not retrieved. Claims (2): - The statutory response period for subject access requests under Jersey's Data Protection (Jersey) Law 2018 is shorter than the GDPR's one-month standard, per practitioner comparison, though the precise number of days was not confirmed from primary legislation in this pass. - Jersey Office of the Information Commissioner — New guidance explaining biometric data and special-category biometric data concepts and how the Data Protection (Jersey) Law 2018 applies when such data is used. #### Rectification And ErasureRed Not located in this pass. Claims (1): - No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law. #### Restriction And ObjectionRed Not located in this pass. Claims (1): - No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law. #### Data PortabilityRed Not located in this pass. Claims (1): - No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law. #### Deadlines And Response WindowsAmber Shorter-than-GDPR SAR deadline confirmed directionally; precise figure outstanding. Claims (1): - The statutory response period for subject access requests under Jersey's Data Protection (Jersey) Law 2018 is shorter than the GDPR's one-month standard, per practitioner comparison, though the precise number of days was not confirmed from primary legislation in this pass. Practitioner commentary confirms Jersey's DSAR response window is shorter than the GDPR's one-month standard, but the precise day-count was not retrieved from primary legislation. Erasure, restriction/objection and portability provisions were not independently located in this pass. Sources and claims (3) - [DataGuidance](https://www.dataguidance.com/opinion/jersey-comparison-between-gdpr-and-jersey-data) — The statutory response period for subject access requests under Jersey's Data Protection (Jersey) Law 2018 is shorter than the GDPR's one-month standard, per practitioner comparison, though the precise number of days was not confirmed from primary legislation in this pass. - [DataGuidance](https://www.dataguidance.com/opinion/jersey-comparison-between-gdpr-and-jersey-data) — No primary or secondary source was located in this pass confirming the specific grounds/exceptions for erasure, the compelling-legitimate-grounds test for restriction/objection, or the scope of any portability right under Jersey law. - [https://www.linkedin.com/company/office-information-commissioner](https://www.linkedin.com/company/office-information-commissioner) — Jersey Office of the Information Commissioner — New guidance explaining biometric data and special-category biometric data concepts and how the Data Protection (Jersey) Law 2018 applies when such data is used. ### JE: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification and security principle well evidenced; five of seven sub-modules unpopulated. Primary framework Data Protection (Jersey) Law 2018 Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Amber Breach notification and security principle well evidenced; five of seven sub-modules unpopulated. D4 · Controller & Processor — Full Module Record 7 sub-modules · 44 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Adequacy received (both EU and UK, general and law-enforcement) is strongly evidenced at T1; transfer-mechanism mechanics beyond adequacy are a gap. Primary framework Commission Decision 2008/393/EC; GDPR Art 97; UK DPA 2018 Schedule 21 / s.74A Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Green Adequacy received (both EU and UK, general and law-enforcement) is strongly evidenced at T1; transfer-mechanism mechanics beyond adequacy are a gap. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 132 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ One concrete, dated sectoral finding (credit-scoring data sharing); seven of eight sub-modules unpopulated. Primary framework Data Protection (Jersey) Law 2018 (sectoral application); Population Register legislative amendment (Jersey, Jan 2026) Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://www.dataguidance.com/news/jersey-joic-issues-statement-personal-data-sharing-uk) Traffic-light rationale — Amber One concrete, dated sectoral finding (credit-scoring data sharing); seven of eight sub-modules unpopulated. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 73 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Entire module rests on an inference from the UK's non-extension rather than a located Jersey instrument. Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Red Entire module rests on an inference from the UK's non-extension rather than a located Jersey instrument. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 67 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Entire module unpopulated by primary or secondary Jersey-specific sources. Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Red Entire module unpopulated by primary or secondary Jersey-specific sources. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 35 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Entire module unpopulated by primary or secondary Jersey-specific sources. Supervisory authority [Jersey Office of the Information Commissioner (JOIC)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Red Entire module unpopulated by primary or secondary Jersey-specific sources. D9 · Children's Privacy — Full Module Record 5 sub-modules · 19 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### JE: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Powers and one concrete enforcement precedent are well evidenced at T2/T3; penalty quantum, funding and redress-mechanism sub-modules are gaps. Primary framework Data Protection Authority (Jersey) Law 2018 Supervisory authority [Jersey Office of the Information Commissioner (JOIC) / Jersey Data Protection Authority (JDPA)](https://ico.org.uk/media2/yfqj5zy1/mou-jersey-20241028.pdf) Traffic-light rationale — Amber Powers and one concrete enforcement precedent are well evidenced at T2/T3; penalty quantum, funding and redress-mechanism sub-modules are gaps. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Jersey Office of the Information Commissioner issued multiple decision notices against Jersey government departments through the first half of 2026: against Infrastructure and Environment on 25 June 2026, against the Department for the Economy on both 13 May 2026 and 25 June 2026, and against the Judicial Greffe on 15 June 2026. These decision notices are drawn directly from the JOIC's own published decision-notices material and represent concrete enforcement output rather than a stated intention to enforce. This enforcement activity sits directly alongside, and substantiates, the more assertive posture articulated in the Commissioner's public statements. On International Data Protection Day 2026, 2 February 2026, Commissioner Paul Vane reaffirmed that enforcement action would be taken without delay where risks to Islanders are identified, a statement reported by Channel Eye and consistent with the enforcement activity that followed in the months immediately after. Reading the decision notices and the public statement together, the evidence supports a reading that the JOIC is not merely stating an intent to enforce more assertively but has, within the same calendar year, demonstrated that intent against multiple public-sector controllers. The concentration of decision notices against government departments specifically — rather than private-sector controllers — is itself notable: it signals that the JOIC's assertive posture extends to public bodies as readily as to the private sector, which is a meaningful signal for any organisation, public or private, assessing how seriously to treat its own data-protection compliance obligations under the Data Protection (Jersey) Law 2018. What remains unconfirmed is the detail of the underlying compliance failures that gave rise to each notice, and the current maximum fine-tier structure under the Data Protection (Jersey) Law was not independently re-verified this period. The decision notices identified are therefore recorded as enforcement activity events; the substantive findings within each notice were not separately assessed. #### Outlook Given the pace of decision notices issued against government departments through mid-2026 and the Commissioner's stated intent to continue swift enforcement, continued enforcement activity should be expected over the remainder of the 2026-2028 Strategic Plan period. Whether that activity extends with similar frequency to private-sector controllers, as distinct from the public-sector concentration observed, is the specific pattern to track going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 99 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties