Registration guidance for sole traders and small businesses

Overview
As of 2021, all entities (inclusive of small businesses and sole traders) who processes personal data and are ‘Established in the Bailiwick’ are required to register with the Authority.

To clarify these terms:
  • ‘Personal data’ refers to any information that relates to an identified or identifiable living individual. It includes data such as: names, physical addresses, phone numbers, email addresses (work-based and personal), photographs / CCTV footage / recordings of individuals, medical data, political views, sexuality, documented opinions of individuals.
  • ‘Processing’ refers to anything an entity does with personal data. It includes activities such as (but not limited to): collecting, storing, organising, using, holding, altering, disclosing, erasing and destroying personal data.
  • You can find further information on the term ‘Established in the Bailiwick’ here.
The only exception to registration would be if you are able to rely on section 4 of The Data Protection (Bailiwick of Guernsey) Law. This would be the ‘Domestic/Household Purposes Exception’ which is clarified in this guidance.

How does this apply to you?
In essence, if you are operating in the Bailiwick and keeping records of (such as in the form of an address book, phone contacts, email contacts, register, filing system etc.) and/or using the contact details of or any other personal information about any person, such as (but not limited to): customers/clients, members, suppliers, staff and volunteers, in the course of your work, it would mean that registration with the Authority would be required. 

You may be captured by the requirement to register with the Authority if you perform activities in the course of your work, such as (but not limited to) the below examples:
  • Producing an invoice for any individual.
  • Recording CCTV footage / taking photographs which capture images of any individuals.
  • Keeping HR records of staff/volunteers.
  • The documented payment of wages to individual staff members.
  • Holding documentation, such as a lease, which identifies an individual.
  • Communications with any individual (letters, phone calls, emails etc.)
  • Contacting individuals via messenger services / social media (WhatsApp, Facebook etc.)
  • Sending promotional material to an individual.
  • Taking bookings from an individual in the course of your work.
  • Delivering goods or performing services at the addresses of individuals.
  • Storing documentation which identifies any individual.
  • Recording details of medical conditions / health data in relation to individuals.
  • The holding of a register of directors and/or shareholders that identifies individuals.
Please note: the Law applies to personal data which has been obtained directly (i.e. the individual themselves providing the data to you) and personal data that has been obtained indirectly (such as that provided to you by another business/sole trader or obtained via publicly available sources).