Do Jersey businesses have to follow UK GDPR?

By Charlie B, Deliberate Design.

The short answer: no. Jersey is not part of the UK, and UK GDPR does not apply to a Jersey business dealing with Jersey customers. Jersey has its own law, the Data Protection (Jersey) Law 2018, which is built along the same lines, and its own regulator, the Jersey Office of the Information Commissioner. The practical difference for a small business is that you register with the JOIC, not the ICO.

What the Jersey law asks

The same things as the UK in substance: tell people what you collect and why, keep it safe, keep it only as long as you need it, let people see and delete it. A privacy page on the website covers the telling.

Registration

Jersey requires data controllers to register with the JOIC and pay a yearly fee. The fee depends on the size of the business and starts at about £70 for the smallest, and the JOIC has been consulting on a new fee model, so check the current figure on jerseyoic.org. The renewal window is at the start of each year and the JOIC has started pursuing businesses that do not register.

If you sell to the UK or Europe

If you deliberately sell to customers in the UK, UK GDPR can apply to that part of your business as well, and likewise EU GDPR for the EU. Jersey is recognised as adequate by both, which makes transferring data between them straightforward. A small shop posting the odd parcel to England is unlikely to need more than a good privacy page.

What the website needs

• A privacy page in plain words
• A contact form that sends to your email and stores nothing on the site
• No tracking cookies, or a real consent banner if you use them
• Your business name and contact details in the footer

Our templates

The privacy and terms pages come with Jersey starter wording, written for the Jersey law rather than the UK one, with your details filled in automatically.

This is general information, not legal advice. For your own case, ask a Jersey advocate or the JOIC.