Resource Room

This guidance applies to data controllers (and in certain circumstances, processors), as defined in the DPJL. It sets out the circumstances in which the Data Protection Authority (Jersey) Law 2018 (DPAJL) will consider it appropriate to issue an administrative fine under the DPAJL. 

This area of our website provides summary guidance on the provisions in Part 8 of the Law, as well as links to more detailed information and guidance about what you must consider when deciding whether to transfer personal data from Jersey to another jurisdiction.

Every individual is entitled to have their personal information protected, used in a fair and legal way, and made available to them when they ask for a copy. If an individual feels that their personal information is wrong, they are entitled to ask for that information to be corrected.

The Data Protection Law makes sure everyone’s personal information is used properly and legally, including children’s. Therefore, it seeks to ensure that images of your children are cared for with respect and likewise it places responsibilities on us all to care for other’s personal information.

The Data Protection (Jersey) Law (DPJL) places direct personal information processing obligations on business and organisations. The DPJL applies to both the public, private, charity and not-for-profit sectors.

This guidance will seek to explain what sanctions the Data Protection Authority (Jersey) Law 2018  has available in law, when the Authority may apply them and who is subject to them. The guidance will also explain how a recipient of a sanction(s) will need to handle such circumstances and what they are required to do.

The Data Protection (Jersey) Law 2018 gives data subjects rights to bring complaints and seek judicial remedies and it brings forward certain criminal offences

The Data Protection (Jersey) Law 2018 provides individuals with a number of rights. The one most commonly used is the right of subject access.

This guidance note will help those processing subject access requests to meet the requirements of the Law including areas often misunderstood.

The rights and duties set out in the Data Protection (Jersey) Law 2018 (DPJL) are designed to apply generally, but there are some exemptions from, and modifications to, various provisions of the DPJL.

This guidance note contains the Commissioner’s guidance on registration under the DPAJL. Registration is a statutory requirement and every controller and processor must register with the Authority.

The Data Protection (Jersey) Law 2018 (DPJL) is based around six principles of ‘good information handling’ (the Principles. This is part of a series of guidance to help individuals and organisations to understand the principles of the Data Protection (Jersey) Law, as well as to promote good practice.

This guidance provides explanations about the definitions used in the law, to help individuals understand their rights and to provide guidance to organisations about how they must process personal information.

Good information handling makes good business sense. You'll enhance your business's reputation, increase customer and employee confidence, and by making sure personal information is accurate, relevant and safe, save both time and money.

The DPJL now places specific legal obligations on processors; ‘a processor is responsible for processing personal data on behalf of a controller and in accordance with the controller’s instructions’

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

This infographic sets out the key points you need to know about consent.

This infographic highlights the key points human resources should know about Data Protection.

This infographic identifies whether or not you need a Data Protection Officer.

This infographic highlights 6 key data protection points for non-profits.

This infographic highlights six important data protection matters for those in the retail sector.

You can limit the way an organisation uses your personal information if you are concerned about the accuracy of the information or how it is being used.

An organisation must inform you if it is using your personal data. Your personal information can only be used if it is being done so lawfully, fairly and transparently.

The information on the following pages is designed to help you to exercise your individual rights and secure a speedy and satisfactory solution, while also explaining how to lodge a complaint in cases where that has been unsuccessful.

The information on the following pages is designed to help you to exercise your individual rights and secure a speedy and satisfactory solution, while also explaining how to lodge a complaint in cases where that has been unsuccessful.

The information on the following pages is designed to help you to exercise your individual rights and secure a speedy and satisfactory solution, while also explaining how to lodge a complaint in cases where that has been unsuccessful

In today’s business world, most organisations and Government of Jersey take data protection and freedom of information very seriously, and the majority of issues are resolved without ever needing to raise a concern with us.

You have the right to be confident that organisations handle your personal information responsibly and in line with good practice.

You have the right to find out if an organisation is using or storing your personal information.

You have the right to get your personal data from an organisation in a way that is accessible and machine-readable, for example as a PDF file.

To help ensure that the appropriate level of training is provided to meet your business and staff needs,
we have created a data protection training checklist to assess what to look for in a training course and/or
package.