35
DAYS LEFT

Registration window open (1 Jan - end of Feb)

If you use personal data in your work you are legally obliged to register during January and February each year.
NEW REGISTRATION? View guidance and create new registration here. 
EXISTING REGISTRATION? Sign-in to Registrations Portal here. 
 

‘I don’t think I need to register’

Think you don't need to register with us? Read our Q&A below.
We often get asked whether someone needs to register, so to make this as clear as possible, below are the three criteria (we call this the 'registration trinity').
If you meet all three criteria you are required to register: 


1. You (whether you are a sole-trader, legal person, organisation, business, charity, landlord, business association etc) are established in the Bailiwick of Guernsey. 
2. You are working with personal data (i.e. any information that may identify individual people, such as your staff members, your clients, your business contacts, your service users, your tenants etc.) 
3. The activity you are performing is not part of your personal/household affairs. 

If you meet the three criteria above then The Data Protection (Bailiwick of Guernsey) Law, 2017 requires you to either register with the Office of the Data Protection Authority directly or use a Levy Collection Agent and pay an annual levy.

There are very few exceptions to the requirement to register, here are some of the common reasons people give when they think they don’t need to register, along with a response:  

 

  • In 2024, the Committee for Home Affairs approved an increase of the registration fees payable to the Data Protection Authority (DPA) from January 2025. 
     

    Fees had remained the same since 2021 despite rising inflation alongside increased demand for education, outreach and enforcement activities.  


    Registered charities and not-for-profit organisations will continue to pay nothing for their registration. Fees for organisations with fewer than 50 full-time equivalent staff (including landlords and sole traders) have increased by £10, from £50 to £60 annually.  


    The fee for organisations with 50 or more full-time staff have increased from £2,000 to £2,400 pounds per year. The largest contributor of fees remains the States of Guernsey, however, their fee contribution has reduced by £50,000 to £250,000. 


    These fee increases fall below the inflationary rate between 2021 and 2024.  

  • The registration fee enables the DPA to fulfil its legal and political requirements to operate independently of the States of Guernsey. Independence is a necessary condition for the DPA’s effective regulatory oversight. Being able to demonstrate this independence played a critical role in the Bailiwick renewing its ‘adequacy’ status with the European Commission. This status allows the free flow of data between the islands and the EU which is a key driver for the Bailiwick’s current and future economic success. 

    Ensuring our jurisdiction has a properly resourced and effective data protection regulator safeguards islanders’ rights, supports businesses’ lawful handling of personal information, and serves to underpin the Bailiwick’s digital strategy. On a practical level, the community benefits from free advice and guidance on matters related to the protection of people's data via: drop-ins, study visits, events, schools' outreach programme and other educational activities. 
     
    The DPA is a 'horizontal’ regulator whose wide regulatory mandate covers the public, private and charitable sectors. It therefore needs to leverage its limited resources to support, respond to, and enforce across all sectors. To give an indication of the breadth of activity the DPA’s team is responsible for, in 2023 it: contributed to 33 events for the local community, educated 1,128 children via its schools’ outreach programme, handled 56 complaints from members of the public against local controllers, processed 151 personal data breaches and published 12 new guidance notes to help organisations comply with the law. 

  • You are considered ‘established’ in the Bailiwick of Guernsey if you are a controller, processor or other person (including legal person) that: 

    • is a Guernsey person, Alderney person or Sark person,
    • maintains in the Bailiwick: 
      (i) an office, branch or agency through which the person carries on an activity, or
      (ii) a regular practice,
    • causes or permits any processing equipment in the Bailiwick to be used for processing personal data otherwise than for the purposes of transit through the Bailiwick, or
    • is engaging in effective and real processing activities through stable arrangements in the Bailiwick
    Please read this guidance document to help determine whether you are ‘established’ in the Bailiwick of Guernsey for the purposes of the Law, and therefore if you have to register or not. 

  • The data protection law only applies if you have any information about (or related to) identifiable people in: 

    • a hard copy filing system*,
    • in hard copy form with the intention of storing it in a hard copy filing system, or
    • in electronic form 
    If you don’t then you don’t need to register with us.  

    So, if you have hard copy data in a form which is organised by any form of referencing, making it easy to locate information about certain individuals, or if you have any information about individuals in electronic form, then you are likely to fulfil the requirements to register. 

    * filing system – any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis 
     

  • If you only have data for your own personal use, for things such as sending Christmas cards or taking pictures for your own enjoyment, the Law does not apply to your processing. 

    If you are uncertain about whether your processing falls within this personal/household definition, we have published this short guidance note with some criteria which may assist you in working out whether you are exempt.  

  • The process of registering with us changed at the start of 2021, so any registrations made prior to that date have not been carried over and you will need to complete a new registration. 

    The difference you need to be aware of is that under the previous registration and fees regime, you could register at any point in the year and your registration would then have been valid for 12 months from the date of registration. Whereas now, due to changes to the law, everyone must register/renew and pay their annual levy during January-February of each year.

     

  • If you do not have any personal data (don’t forget that includes information about staff and clients) in respect of your own organisation, but you do process it on behalf of another organisation, you are a 'processor' under the Law.

    Although this means that you do not have many of the statutory obligations of a controller, you do still need to register and pay an annual levy. 

  • If you have authorised an ODPA Levy Collection Agent (LCA) to pay your annual levy, you do not need to register directly with the ODPA.

    But remember, you retain full legal responsibility for how you use people’s data, and you are still obliged to meet your legal duties under data protection law.  
     
    You do need to make sure that you have a valid Certificate of Exemption (which your LCA must provide you) which you may be asked to show to the ODPA. 

    Find out more about the role of an LCA here. 

  • If you are a not-for-profit organisation (as defined in section 4(1) of The Charities and Non Profit Organisations (Enabling Provisions)(Guernsey and Alderney) Law, 2009 you do need to register with the ODPA and meet your legal duties under data protection law. 

    But you will not need to pay an annual levy. 

    • If you have established a new business/organisation this year, you do not need to register until next year*. 
    • Please diarise to come back during next year's registration window: 1 January – end of February to register and make your annual payment.
    • You may also wish to sign up to our newsletter as we will include reminders as the registration period approaches. 
    • In the meantime, please continue to work on compliance to ensure you are taking steps to meet your other legal duties under The Data Protection (Bailiwick of Guernsey) Law, 2017.
    * unless you answer yes to any of these four questions: 
    1. Do you employ 50+ Full Time Equivalent (FTE) staff?
    2. Are you required by law to appoint a Data Protection Officer?
    3. Do you act as an ODPA Levy Collection Agent?
    4. Are you a non-profit organisation (States of Guernsey Deputies are included under ‘non-profits’)?

    If you answer yes to any of the above questions you must register directly with the ODPA when you first set up your business. Please see question 15 in the Everything you need to know about ODPA Registration & Levy Regime for more detail. 

  • The ODPA endeavours to support the regulated community in respect of their statutory registration duties.

    Where an individual or organisation knowingly and wilfully fails to comply with any element of the Law, including registration and levy duties, this may be considered an offence and the ODPA has the power to take action and recover unpaid levies. 

    If you would like to know more about this approach please see: Registration and Levy Duties – Regulatory Approach Summary.