What is Jersey data protection law?

In plain English

Jersey data protection law is the island’s set of rules for handling information about people. The main statute is the Data Protection (Jersey) Law 2018. It covers duties for organisations processing personal data and rights for the people the information is about. A companion law, the Data Protection Authority (Jersey) Law 2018, establishes the authority and includes registration and enforcement provisions.

Think of customer details as items left in your care. You need a sound reason to collect them, should tell people what you are doing, keep them safe and avoid holding more than you need. The law is more detailed than that analogy, but it is a useful starting point for a small website. An enquiry form, mailing list, online order or analytics setup can all involve information about identifiable people.

The Jersey Office of the Information Commissioner, usually called JOIC, is the island’s regulator. Its guidance helps businesses understand the rules. Jersey’s regime follows principles equivalent to the EU GDPR, as Government of Jersey explains, but it is Jersey’s own law. Calling it simply “UK GDPR” can hide the duties that apply locally.

Why it matters to a Jersey business

Even a small service website may collect a visitor’s name, phone number and details of the work they want done. Those details need a lawful purpose, a clear explanation and appropriate safeguards. A form that sends enquiries to an inbox is still processing personal data. The business should know who can access that inbox, how long messages are kept and whether a supplier handles them on its behalf.

JOIC’s registration guidance says controllers and processors established in Jersey that process personal data generally must register, subject to limited exemptions. Registration and any charge are distinct questions; the guidance explains both. Check the current position for your organisation instead of assuming a small business is exempt.

A privacy notice should tell people, in clear language, who is using their data and why. JOIC’s privacy notice checklist sets out information to consider, including purposes, lawful basis and contact details. The notice should describe the site as it actually works, including any form, newsletter, booking or measurement tools.

A Jersey example

Imagine a Jersey gardener whose contact form asks for a name, telephone number, parish and a short description of the job. The business can explain that the details are used to answer the enquiry and arrange a quotation. It can limit access to the inbox, avoid requesting unnecessary personal details and set a sensible retention practice. If a third-party form provider stores submissions, that arrangement should be understood too.

This is a hypothetical example, not legal advice for a particular business. The correct lawful basis and notice wording depend on the actual processing. A business handling sensitive information, children’s data or complex international transfers needs a more careful review.

What to do

Make a short inventory of every place the website collects or sends information: contact forms, bookings, orders, mailing lists, analytics, cookies and embedded tools. For each, record what data is collected, why, where it goes, who can see it and when it is deleted. Check whether JOIC registration applies. Write or update the privacy notice from those facts, then make it easy to reach from the form and site footer.

Test the site against the notice. If analytics begins before a visitor’s choice where consent is relied on, or a form sends data to an unlisted provider, the words and implementation disagree. Review the setup when a new tool is added. Our Jersey website legal requirements guide covers related business details, cookies and selling information; this page explains the data protection term.

Common myths

Jersey businesses only need to follow UK GDPR. Jersey has its own 2018 law. Other regimes may also matter depending on where and how a business operates.

A simple contact form is outside data protection. Names and email addresses can identify people, so the form’s handling needs attention.

A privacy policy copied from another site is enough. It may describe tools or practices you do not use and omit ones you do. Your notice must fit your actual processing.

Our take

Jersey Web’s view is to begin with a plain inventory of what the website collects, then make the notice and technical setup match it. That gives the business a practical way to review new tools later. For legal interpretation or unusual processing, seek advice from a qualified professional or JOIC’s published guidance.