Jersey Office of the Information Commissioner

Jersey Office of the Information Commissioner Our mission is to promote respect for the private lives of individuals.

Data Breach: Would You Know What to Do?A data breach occurs when personal data — including special category data — is ac...
09/09/2026

Data Breach: Would You Know What to Do?

A data breach occurs when personal data — including special category data — is accidentally or deliberately:
• Disclosed or shared without proper authorisation
• Accessed without authorisation
• Lost or corrupted
• Changed without permission

Examples include:
• Sending an email to the wrong person, or attaching the wrong file or recipients in CC instead of BCC
• An employee accessing a colleague’s or client’s information without a legitimate reason
• Losing paper records, laptops, phones or other devices containing personal data
• Changing personal information without authorisation

🚨 When did you last review your Breach Response Plan?
Being prepared can make all the difference when something goes wrong.

📋 Check out our Breach Response Plan Checklist here:https://jerseyoic.org/media/guidance-downloads/checklist-breach-support-plan.pdf

https://jerseyoic.org/guidance/data-protection/data-breaches/data-breaches-what-they-are-and-how-to-deal-with-them

We encourage calls helping small business owners to understand their data protection priorities, helping to keep advice ...
09/09/2026

We encourage calls helping small business owners to understand their data protection priorities, helping to keep advice practical and proportionate.

🔹 We support owners of smaller businesses to navigate data protection, including the aftermath of a data protection breach. Breaches can cause anxiety and upset for business owners as well as data subjects and we are here to support where possible.

🔹 We make data protection topics easier to understand to help those handling personal information access the data protection guidance they need with confidence and make informed decisions.

Have you viewed our easy-to-read subject matter guidance and templates on our website?

🔹 They begin with simple overviews for beginners and individuals, then move on to more detailed, technical guidance for those who are familiar with the topics.

🔹 You can use the menu on our website to jump straight to topics of interest or download helpful resources. If you have questions or need further advice, please contact us.

✅ Here's the link to our guidance: https://jerseyoic.org/guidance

🎯 Our 2026–2028 Strategic PrioritiesOur 2026–2028 Strategic Priorities set out how we’ll continue to deliver on our purp...
08/09/2026

🎯 Our 2026–2028 Strategic Priorities

Our 2026–2028 Strategic Priorities set out how we’ll continue to deliver on our purpose:

“To provide those who interact with Jersey organisations and Government with the highest standard of personal data protection.”

Our strategy focuses on three key priorities, reflecting some of the most significant privacy challenges and risks facing individuals.

Our approach is focused on making a meaningful, lasting difference to data protection in Jersey.

🔎 Want to know more?

Discover our three strategic priorities and our Triple A approach on our website: https://jerseyoic.org/governance/strategic-priorities-2026-2028

'Handling a Subject Access Request is greater than the sum of its parts'We've still a few spaces left at our Let's Go DP...
07/09/2026

'Handling a Subject Access Request is greater than the sum of its parts'

We've still a few spaces left at our Let's Go DPO session taking place at 1pm on Tuesday 15 September 2026.

Let’s Go DPO is our support network giving Data Protection Officers and those that have responsibility for data protection the chance to network, identify and explore common experiences and engage with our office in a safe and confidential environment.

All are welcome at our Let's Go DPO sessions and they are free of charge.

You can register for next week's session here on our website: https://www.jerseyoic.org/events/handling-a-subject-access-request-is-greater-than-the-sum-of-its-parts

Summer 2026 Enforcement Activities - Lessons LearnedData protection compliance isn’t about having policies on paper.It’s...
07/09/2026

Summer 2026 Enforcement Activities - Lessons Learned

Data protection compliance isn’t about having policies on paper.

It’s about being able to demonstrate that the right things are happening in practice.

Recent enforcement activity offers a clear reminder: having a policy isn’t enough. Making it work is what matters.

👉 Read our lessons learned here https://jerseyoic.org/articles/summer-2026-enforcement-activities-lessons-learned

Summer Enforcement Activities - Lessons LearnedThe common theme: the most important lesson from enforcement activity is ...
04/09/2026

Summer Enforcement Activities - Lessons Learned

The common theme: the most important lesson from enforcement activity is that saying you comply is not the same as demonstrating compliance.

You should be able to evidence your approach, from the purpose for processing personal information, through to handling Subject Access Requests, maintaining accurate Privacy Notices, training staff, recording consent, disposing of information and managing processors. But again, keep it simple and proportionate to the size of your organisation and the nature of the data you are holding.

Enforcement activity gives those using personal information an opportunity to learn without having to do so the hard way.

The question is not simply, “Do we have the right arrangements in place?” It is, “Can we demonstrate that they work?”

https://jerseyoic.org/articles/summer-2026-enforcement-activities-lessons-learned

Stay in the loop with our Stay in Touch newsletter!Get timely updates about our latest enforcement action, priorities an...
03/09/2026

Stay in the loop with our Stay in Touch newsletter!

Get timely updates about our latest enforcement action, priorities and work we’re doing. You’ll also receive practical data protection guidance and news about our upcoming events and community outreach activities.

Want to stay informed, empowered and a step ahead?

Subscribe today at https://jerseyoic.org/stay-in-touch

Summer Enforcement Activities - Lessons Learned ➤ Keep control of your processors.Using an outsourced third party to pro...
03/09/2026

Summer Enforcement Activities - Lessons Learned

➤ Keep control of your processors.

Using an outsourced third party to process personal information does not remove the need for proper oversight. Responsibility remains with the data controller. Where a data processor is engaged, an appropriate contract should clearly set out the processing activities, responsibilities and obligations of the parties.

➤ The Lesson: understand what your processors are doing, and make sure your contracts properly reflect it. Also undertake a level of due diligence and check they are appropriately registered with us, before sharing any personal information: https://jerseyoic.org/register-renew

Access our Appointing a Data Processor guidance, here:https://jerseyoic.org/media/guidance-downloads/appointing-a-data-processor.pdf

📋 Data Breach LogsUnder Article 20(5) of the DPJL 2018, data controllers must keep detailed records of all data breaches...
02/09/2026

📋 Data Breach Logs

Under Article 20(5) of the DPJL 2018, data controllers must keep detailed records of all data breaches, including:

🔹 The facts and circumstances of the breach
🔹 Impact assessments and remedial actions taken

These records aren’t just for internal use — they may be subject to inspection by us, as part of compliance monitoring.

✅ Be prepared: We’ve created a template to help you maintain your breach log and keep your records up to date.
https://jerseyoic.org/guidance/data-protection/data-breaches/data-breaches-what-they-are-and-how-to-deal-with-them -log-requirements

Address

2nd Floor, 5 Castle Street
St. Helier
JE23BT

Opening Hours

Monday 08:45 - 17:00
Tuesday 08:45 - 17:00
Wednesday 08:45 - 17:00
Thursday 08:45 - 17:00
Friday 08:45 - 17:00

Telephone

+441534716530

Website

Alerts

Be the first to know and let us send you an email when Jersey Office of the Information Commissioner posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Jersey Office of the Information Commissioner:

Shortcuts

Share

Category