Section 39 of the DPL 2017 prohibits all controllers and processors established in the Bailiwick from processing personal data unless they have registered with the ODPA. Failure to comply with section 39 of the DPL 2017 is a criminal offence.

The Authority may prescribe the form and manner of registration. These particulars are described in the Data Protection (General Provisions) (Bailiwick of Guernsey)  Regulations, 2018 (as amended) (the "Registration Regulations")) which set out the framework for a new registration and levy collection regime applicable from 1 January 2021. The new regime abolishes the previous set of exemptions from registration (which expired on 31 December 2020) and replaces them with a much narrower sub-set of exemptions.

The Registration Regulations also introduce the concept of a 'Levy Collection Agent', which is, in essence, a regulated entity licensed by the Guernsey Financial Services Commission (GFSC) who has been appointed to collect an entity's registration fees on its behalf.

Importantly, whilst a Levy Collection Agent has certain responsibilities under the Registration Regulations (which include submitting an annual return, preparing and issuing certificates of exemption to all relevant entities which it administers and retaining records on such entities for a period of 6 years), the ODPA has clarified in its guidance that "all the legal responsibility as well as liability for data protection compliance still rests with [the controller/processor]…[and in this regard Levy Collection Agents] are simply … a payment gateway to assist with the administrative requirements for the regulated community."

Exemptions

Certain limited exemptions to the requirement to register are available to some controllers and processors under the Registration Regulations. These include, for example, where the controller and/or processor has appointed a Levy Collection Agent on its behalf. Not all entities will be eligible to appoint a Levy Collection – this route is only available to organisations who employ fewer than 50 FTE employees, are not required by law to appoint a DPO, do not already act as a Levy Collection Agent and are not nonprofits. 

If a controller or processor seeks to rely on any one exemption, they must document their rationale for their decision.

Registration particulars

Since the introduction of the DPL 2017, the ODPA has streamlined the registration regime, both from an outward-facing and internal perspective.  For example, in accordance with the GDPR's approach, the register is no longer available to be searched online, thereby removing the requirement for the ODPA to maintain a public register containing significant volumes of processing details. The ODPA has also removed the requirement for controllers and processors to include details about the types of processing undertaken and no longer requires entities to provide a description of the categories of data subject or details of the countries to which such data is transferred.

Instead, at the time of writing, a controller or processor established in the Bailiwick who is required to register with the ODPA must give the ODPA an online annual return setting out the following information (as stipulated in the Registration Regulations):

• the contact details (including name and principal business address) of the entity to be registered;
• confirmation of whether the entity is a controller, processor or both in relation to the processing activities;
• the representative¹ appointed (if the entity is based outside the Bailiwick);
• confirmation of whether the entity is a charity / not-for-profit;
• the DPO (as applicable);
• confirmation of whether the entity employs 50 or more full time equivalent employees;
• confirmation of whether the entity has agreed to act as Levy Collection Agent.

The return must also be accompanied by a levy, which will be calculated depending on the status of the organisation (i.e. if it is a charity / not for profit) and the number of full-time equivalent employees employed by the entity.

Levy Collection Agents are required to submit a slightly different set of information to the ODPA, as follows:

• the contact details (including name, principal business address and GFSC number) of Levy Collection Agent;
• confirmation of whether the entity is a controller, processor or both in relation to the processing activities;
• the DPO (as applicable);
• confirmation of whether the entity employs 50 or more full time equivalent employees;
• Declaration of the number of organisations the Levy Collection Agent is acting for.

The return must also be accompanied by a levy (being the aggregate of its own fees plus those of the entities that it administers).

There are two levels of fees (which are as follows with effect from 1 January 2025):

• For organisations with 1-49 full-time equivalent (FTE) employees - £60 per annum; or
• For organisations with 50 or more FTE employees - £2,400 per annum.

The Registration Regulations stipulate separate levies are applicable when dealing with certain government bodies.

The States of Guernsey pay a flat rate fee of £250,000. Registered charities and not for profit organisations pay nothing.