‘I don’t think I need to register’

Think you don't need to register with us? Read our Q&A below.
Remember, if you, or your organisation, are:
  • working with personal data, and
  • established in the Bailiwick of Guernsey
then The Data Protection (Bailiwick of Guernsey) Law, 2017 requires you to either register with the Office of the Data Protection Authority directly or use a Levy Collection Agent and pay an annual levy.

There are very few exceptions to the requirement to register, here are some of the common reasons people give when they think they don’t need to register, along with a response:  

 

  • The data protection law only applies if you have any information about (or related to) identifiable people in: 

    • a hard copy filing system*,
    • in hard copy form with the intention of storing it in a hard copy filing system, or
    • in electronic form 
    If you don’t then you don’t need to register with us.  

    So, if you have hard copy data in a form which is organised by any form of referencing, making it easy to locate information about certain individuals, or if you have any information about individuals in electronic form, then you are likely to fulfil the requirements to register. 

    * filing system – any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis 
     

  • If you only have data for your own personal use, for things such as sending Christmas cards or taking pictures for your own enjoyment, the Law does not apply to your processing. 

    If you are uncertain about whether your processing falls within this personal/household definition, we have published this short guidance note with some criteria which may assist you in working out whether you are exempt.  

  • You still need to register from scratch on the new portal.

    In the previous registration and fees regime, the registration period was 12 months from the date of registration.

    The new registration and fees regime applies per calendar year and the law was changed to reflect that. This means that the levy is payable by all controllers and processors between January and February 2021 and then yearly after that. 

  • If you do not have any personal data (don’t forget that includes information about staff and clients) in respect of your own organisation, but you do process it on behalf of another organisation, you are a 'processor' under the Law.

    Although this means that you do not have many of the statutory obligations of a controller, you do still need to register and pay an annual levy. 

  • If you have authorised an ODPA Levy Collection Agent (LCA) to pay your annual levy, you do not need to register directly with the ODPA.

    But remember, you retain full legal responsibility for how you use people’s data, and you are still obliged to meet your legal duties under data protection law.  
     
    You do need to make sure that you have a valid Certificate of Exemption (which your LCA must provide you) which you may be asked to show to the ODPA. 

    Find out more about the role of an LCA here

  • If you are a not-for-profit organisation (as defined in section 4(1) of The Charities and Non Profit Organisations (Enabling Provisions)(Guernsey and Alderney) Law, 2009 you do need to register with the ODPA and meet your legal duties under data protection law. 

    But you will not need to pay an annual levy. 

  • The ODPA will endeavour to support the regulated community in respect of their statutory registration duties.

    Where an individual or organisation knowingly and wilfully fails to comply with any element of the Law, including registration and levy duties, this may be considered an offence and the ODPA has the power to take action and recover unpaid levies. 

    If you would like to know more about this approach please see: Registration and Levy Duties – Regulatory Approach Summary