Browse the Guidebook

Run it properly

Register for data protection in

If you hold customers’ names or emails, you register with your regulator — and you have duties after.

CheckedEdition 1.0Checked 25 October 20265 stepsGuernsey

Herm has no government of its own: it is owned and administered by the States of Guernsey, which have leased the whole island to one tenant company since 2008 — so Guernsey’s laws, taxes and registries apply there.

In each place above, a business that handles personal data — customers’ names and emails count — registers with its regulator, and in most cases pays a yearly fee.

Who does them
  • 5 You · 100%
  1. Register with the Office of the Data Protection AuthorityYouOffice of the Data Protection Authority

    Every business established in the Bailiwick that handles personal data registers with the Office of the Data Protection Authority (ODPA), sole traders included. From 1 January 2026: £62.22 a year under 50 staff, £2,488.80 from 50; registered charities register free.

  2. Say what you collectYou

    Your privacy policy says what you collect, why, who sees it and how long you keep it. Your legal pages do this for your site; tell me about anything else you collect.

  3. Answer requests on timeYou

    When someone asks for the data you hold about them: within 4 weeks in Jersey (always 28 days), and within a month in Guernsey and the UK (to the same date next month, 28 to 31 days).

  4. Report a breach within 72 hoursYou

    If personal data is lost or exposed and people could be harmed, tell your regulator within 72 hours of finding out (3 days, weekends included) — even before you know everything.

  5. Data can travelYou

    The European Commission treats Jersey and Guernsey as giving adequate protection, so personal data can flow between them and the EU without extra paperwork.

Keep going

Words in this journey:Data controllerSole trader