Browse the Guidebook

Run it properly

Register for data protection in

If you hold customers’ names or emails, you register with your regulator — and you have duties after.

CheckedEdition 2.0Checked 6 November 20265 stepsJersey

In each place above, a business that handles personal data — customers’ names and emails count — registers with its regulator, and in most cases pays a yearly fee.

5 steps, across the order
  • 4 Before you apply · 80%
  • 1 Straight after · 20%
Who does them
  • 5 You · 100%
What each costs, from the cheapest choice
  • Register with the Information Commissioner£70
Before you applyDecide and gather: nothing here costs anything yet.
  1. Say what you collectYou

    Your privacy policy says what you collect, why, who sees it and how long you keep it. Your legal pages do this for your site; tell me about anything else you collect.

  2. Answer requests on timeYou

    When someone asks for the data you hold about them: within 4 weeks in Jersey (always 28 days), and within a month in Guernsey and the UK (to the same date next month, 28 to 31 days).

  3. Report a breach within 72 hoursYou

    If personal data is lost or exposed and people could be harmed, tell your regulator within 72 hours of finding out (3 days, weekends included) — even before you know everything.

  4. Data can travelYou

    The European Commission treats Jersey and Guernsey as giving adequate protection, so personal data can flow between them and the EU without extra paperwork.

Straight afterWhat waits on the first step being done — in this order.
  1. Register with the Information CommissionerYouthe JOIC£70 a year, under ten full-time staffRenewed every January to February

    A limited company must register with the Jersey Office of the Information Commissioner — it holds personal data from the start, in its register of shareholders and directors. The charge is set by staff numbers and revenue; under ten full-time staff, it begins at £70. A new registration’s charge is due a month after you register. It expires on 31 December and is renewed between 1 January and the last day of February; changes are reported within 28 days. A sole trader or partnership registers once it collects customers’ details — names, addresses, phone numbers or emails.

    Data protection registration

Keep going

Words in this journey:DirectorMemberData controllerSole traderLimited company