My Tech Jersey

10/03/2026

If you’re a landlord in Jersey, you may have a data protection obligation you’re not aware of.

Many landlords store tenant information such as:

• names and contact details
• tenancy agreements
• ID documents
• bank or payment information
• references and background checks

If you store or manage this type of information digitally (or even in organised files), you are processing personal data.

That means you may be required to register with the Jersey Office of the Information Commissioner (JOIC) under the **Data Protection (Jersey) Law 2018.

This applies even if you only rent one or two properties.

Many landlords assume data protection rules only apply to large companies — but the law focuses on how personal data is handled, not the size of the business.

Some simple questions worth asking:

• Are tenant records stored securely?
• Are copies of ID or contracts stored safely?
• Could a lost laptop or email breach expose tenant information?
• Are you properly registered with JOIC if required?

At myTechJersey, we help local organisations understand their digital risk and data handling responsibilities through the Jersey Digital Risk Index (JDRI).

If you're unsure whether your current setup exposes you to risk, you can start with our Digital Risk Check:

https://mytechjersey.com/digital_risk_check.html

It takes a few minutes and can highlight issues many landlords never realise they have.

A short 10-question Digital Risk Check for Jersey SMEs, reviewed personally and returned in plain business language.

10/03/2026

Digital risk doesn’t end with the purchase of some anti-virus software.

For many small businesses, cyber security still feels like a technical problem.

Install a security tool.
Renew the licence every year.
Assume everything is fine.

Unfortunately, that’s not how digital risk works anymore.

In Jersey, businesses that handle personal data already have responsibilities under the Data Protection (Jersey) Law, overseen by the Jersey Office of the Information Commissioner (JOIC).

And with the proposed Cyber Security (Jersey) Law moving forward, expectations around digital resilience and operational risk are only increasing.

But the biggest issue we see with SMEs isn’t usually technology.

It’s visibility.

Many business owners simply don’t know the answers to questions like:

• Are we properly registered for data protection?
• Could a phishing email compromise our business accounts?
• Do we actually know where our data is stored and backed up?
• What would happen if our systems went offline tomorrow?

These aren’t just IT questions.

They’re business continuity and governance questions.

At myTechJersey, we built the Jersey Digital Risk Index (JDRI) to help organisations understand their real digital exposure across cyber security, infrastructure, data protection and operational resilience.

If you want a quick sense of where your organisation currently stands, you can complete our Digital Risk Check here:

https://mytechjersey.com/digital_risk_check.html

It only takes a few minutes — and many organisations are surprised by what it highlights.

A short 10-question Digital Risk Check for Jersey SMEs, reviewed personally and returned in plain business language.

06/03/2026

🔐 Cyber security regulation is coming to Jersey — and it will affect more businesses than many realise.

The proposed Cyber Security (Jersey) Law is moving through the legislative process and signals an important shift.

Cyber resilience is no longer just an IT issue.
It is becoming a business governance responsibility.

Initially the law will focus on critical infrastructure and essential services, but the wider direction is clear: expectations around cyber security and digital resilience are increasing across the whole economy.

For many Jersey SMEs, the challenge isn’t necessarily installing security tools.

It’s answering a much simpler — but more difficult — question:

Do you actually know your organisation’s digital exposure?

Many businesses don’t have clear visibility of:

• cyber security risks
• email and phishing exposure
• infrastructure and supplier dependencies
• data protection posture
• business continuity readiness

That’s exactly why we developed the Jersey Digital Risk Index (JDRI) at myTechJersey.

The framework helps organisations understand and evidence their real operational digital risk position — something that will become increasingly important as cyber regulation evolves.

Preparing early is almost always easier (and cheaper) than reacting later.

Jersey’s digital economy is growing rapidly — and resilience needs to grow with it.

👉 If you run a Jersey business and want to understand your organisation’s digital risk exposure, feel free to reach out.

26/02/2026

Most Jersey businesses think they’re “too small” to have digital risk.

They’re wrong.

Here’s a quick thought exercise:

Who has access to your main email inbox?

If your laptop died today, how long would it take to recover everything?

Are your backups tested — or just assumed?

Do you know where your customer data actually lives?

If a staff member left tomorrow, could you revoke every access point confidently?

Most SMEs don’t have a cyber problem.

They have a visibility problem.

Risk in small businesses rarely looks dramatic.

It looks like:

• A shared Gmail login

• An ex-employee still on the bank mandate

• Website hosting nobody can access

• Customer details stored “somewhere safe”

• A domain renewal nobody is tracking

None of this feels urgent — until it is.

The uncomfortable truth is that operational fragility compounds quietly. And small islands amplify that risk because talent, time and redundancy are limited.

At MyTechJersey, we don’t sell “IT support.”

We help local businesses:

✔ Map digital exposure

✔ Audit access control

✔ Review data handling practices

✔ Strengthen operational resilience

✔ Reduce single-point dependency

✔ Improve governance without adding complexity

If you run a business in Jersey, here’s your learning takeaway:

Control is not the same as familiarity.

Just because you’ve always done it that way doesn’t mean it’s protected.

And just because nothing has gone wrong yet doesn’t mean your setup is robust.

If this post made you slightly uncomfortable — that’s useful.

Awareness is the first layer of resilience.

—

MyTechJersey

Digital risk clarity for local business.

My Tech Jersey

20/02/2026

🔎 A Privacy Policy Is Not a Privacy Strategy

Many Jersey professional services firms have well-written privacy notices on their websites.

They reference the Data Protection (Jersey) Law 2018.
They mention lawful bases.
They outline subject access rights.

On paper, everything looks aligned.

But here’s the uncomfortable question:

👉 Does your internal operational reality actually match what your website says?

Handling:

• High-value personal financial data
• Sensitive suitability information
• Identity documentation
• Ongoing transactional records
• Email chains containing personal detail

Now ask yourself:

– Is every mailbox access-controlled and reviewed?
– Do former staff retain residual system access?
– Is client data stored anywhere it shouldn’t be (shared drives, personal devices, unmanaged cloud tools)?
– Are retention periods actively enforced — or simply stated in policy?
– If a Subject Access Request landed tomorrow, could you respond confidently and quickly?

For many firms, the gap between “published compliance” and “operational compliance” is wider than they realise.

In Jersey’s regulated environment, reputation risk travels faster than enforcement letters.

A structured GDPR & Data Privacy review isn’t about ticking boxes. It’s about stress-testing the real controls behind your client trust model.

If you operate in a high-trust, high-discretion sector and haven’t reviewed your privacy controls in the last 12–18 months, it may be time.

Compliance should be demonstrable — not assumed.

My Tech Jersey

17/02/2026

Most small businesses don’t think of themselves as “handling personal data”.

But if you:

• Write a customer’s name and phone number in a notebook
• Keep a spreadsheet of regular clients
• Store email addresses for repeat work
• Save delivery details in WhatsApp
• Hold paper order forms in a drawer

You are processing personal data.

And that means data protection law applies.

Under the Data Protection (Jersey) Law 2018 — Jersey’s equivalent of General Data Protection Regulation (GDPR) — the size of your business doesn’t exempt you from responsibility.

It doesn’t matter whether the data is:

• In a CRM
• In Gmail
• In a spreadsheet
• Or written on paper

If you can identify a living person from it, it’s protected.

Where small businesses often get caught out:

– No clear reason recorded for collecting the data
– No retention period (data kept “just in case”)
– No secure storage process
– No deletion process
– No privacy notice explaining what happens to the data

It’s rarely malicious.

It’s usually informal growth.

But informal data handling becomes risky the moment:

• A customer makes a complaint
• A device is lost
• A notebook goes missing
• An employee leaves
• Or a data subject access request lands

Good governance isn’t about bureaucracy.

It’s about knowing what you hold, why you hold it, and how you protect it.

If you run a Jersey SME, it’s worth asking:

Do you actually know where all your customer data lives?

16/02/2026

Over the past few weeks, while reviewing digital risk exposure across local Jersey SMEs, one pattern keeps appearing:

Many businesses are still running entirely from personal email accounts.

Gmail.
iCloud.
Hotmail.

There’s nothing “wrong” with that — it works.

But here’s the real question:

Who actually owns your business email?

If the mailbox is technically tied to a personal account rather than the business itself, it usually means:

• No administrative control layer
• No enforced security policy
• No structured offboarding process
• No proper email authentication (SPF / DKIM / DMARC)
• No clean CRM integration
• No separation between personal and customer data

It’s rarely a branding issue.

It’s a governance issue.

And it only becomes visible when:
– Staff join or leave
– Access needs to be restricted
– A security incident occurs
– The business grows
– Or the business is sold

Email is often the single most critical system in a small business — yet it’s rarely audited.

If you’re unsure whether your setup is truly “owned by the business” rather than just used by it, it’s worth checking.

Control beats convenience.

14/02/2026

Do you have full control of your business email?

More specifically:

• Do you know exactly who has administrative access?
• When was the last time you reviewed mailbox permissions?
• Are former staff accounts fully disabled — not just “inactive”?
• Is multi-factor authentication enforced across all admin roles?

Email is still the primary entry point for most breaches.

Calm environments are maintained — they do not happen by accident.

—
My Tech Jersey

12/02/2026

Introducing the Jersey Digital Risk Index

Today marks the launch of the Jersey Digital Risk Index — a structured daily assessment of digital and infrastructure risk conditions affecting homes and small businesses in Jersey.

Each weekday, we will publish a measured score reflecting:

• Infrastructure stability
• Cyber threat activity
• Software and device vulnerabilities
• Regulatory and advisory signals
• Economic and digital service volatility

The Index is generated using structured AI-assisted monitoring combined with local weighting logic and final oversight before publication.

The objective is simple:

To provide calm, practical awareness — without noise or sensationalism.

Digital risk does not need to be dramatic to matter.
Most days are stable.
Some days require attention.

We will report both with equal discipline.

https://mytechjersey.com/jdri.html
—
My Tech Jersey Ltd
Calm digital risk insight for Jersey.

A calm daily bulletin tracking Jersey-relevant digital and operational risk signals.

09/02/2026

I run My Tech Jersey, providing practical, security-conscious technology support for small organisations that want clarity without jargon or drama.

The work focuses on short operational health checks, plain-English IT advisory, and incident readiness — keeping scope tight and delivery calm.

My Tech Jersey has been operating since 2015, working with systems and processes where reliability, evidence, and security actually matter. We tend to work quietly and selectively.

If this sounds useful — or you know someone it might help — feel free to message me or point them to mytechjersey.com