Crown Dependencies
Jersey, Guernsey and the Isle of Man
Your UK programme stops at the water
The Crown Dependencies are not part of the United Kingdom. UK GDPR does not extend to them, the ICO does not regulate them, and a UK group with an island entity is answering to a different law and a different regulator than the one its policies name.
24 hours
to report a significant cyber incident to the Jersey Cyber Security Centre, once the operator duties commenceCyber Security (Jersey) Law 2026
December 2026
when the parts identifying and governing operators of essential services come into forceNot in force yet
3
separate data protection laws and three separate regulators across the islandsNone of them the ICO
Every one
Jersey bank registered under Part 2 of the Banking Business (Jersey) Law 1991 is automatically in scopeNo threshold test
Three jurisdictions, three regulators, and none of them is the ICO
The islands wrote their own legislation deliberately close to the GDPR, so that data would keep flowing. That similarity is what causes the problem: a UK policy pack reads as though it fits, right up to the point where somebody asks which regulator you would notify and under which law.
What your UK programme already covers
- UK GDPR and the Data Protection Act 2018
- Reporting to the ICO within 72 hours
- The Article 33(5) internal breach record
- UK transfer mechanisms and the IDTA
- Your DPO or the decision not to appoint one
What it does not reach
- Jersey. The Data Protection (Jersey) Law 2018, regulated by the Jersey Data Protection Authority
- Guernsey. The Data Protection (Bailiwick of Guernsey) Law 2017, regulated by the Office of the Data Protection Authority, covering Guernsey, Alderney and Sark, with its own registration and annual levy
- Isle of Man. The Data Protection Act 2018 with the GDPR and LED Implementing Regulations 2018, regulated by the Isle of Man Information Commissioner
- Jersey cyber. A separate regime again, run by the Jersey Cyber Security Centre rather than by any privacy regulator
Four of these cannot be met by mapping. They need a named law, a named regulator and a named person on the island side.
In force, and not in force
The Cyber Security (Jersey) Law 2026, stated precisely
It was approved by the Privy Council on 3 June 2026. On 1 September 2026 the parts governing the Jersey Cyber Security Centre came into force. The parts that identify and govern operators of essential services are due in December 2026. Until then, the operator duties below are coming, not binding.
When they do commence, an operator of essential services must notify the Minister that it is in scope, take appropriate and proportionate measures to manage cyber risk, and report a significant incident to the Director of the Jersey Cyber Security Centre within 24 hours of becoming aware of it. Civil penalties run to around £10,000, and giving false or misleading information can be a criminal matter.
Every entity registered under Part 2 of the Banking Business (Jersey) Law 1991 is an operator of essential services automatically. There is no size threshold to fall under.
What we do
The island delta sheet
One page for each island: the law that applies, the regulator you would actually contact, whether you must register or pay a levy, and the clock that starts when something goes wrong. Written so you can check your own position before you decide whether you need anybody.
- Jersey, Guernsey and the Isle of Man side by side
- Where each differs from UK GDPR in a way that changes what you do
- Dated, with the source named
Free
Jersey cyber readiness review
Whether the operator duties will reach your entity in December, and what you would have to be able to show on the day they do. Ends with a written position you can put to a board.
- In scope or not, and on what reading
- Whether you could report inside 24 hours today
- What to have in place before commencement
Priced on scope
Scoping, honestly
Why Scotland is not on this page
Because it does not belong here. Data protection is reserved: Scotland, Wales and Northern Ireland are under UK GDPR and the Data Protection Act 2018, regulated by the ICO, exactly as England is. There is no Scottish GDPR, and anyone selling you one is confused.
Where the four nations genuinely diverge is health and public sector assurance rather than privacy law, and that belongs with our NHS work, not here. We would rather say so than pad this page out.
The limits of this
What we will not tell you
We are not admitted to practise law in any of these jurisdictions and we do not give legal advice. On a question that turns on the wording of an island statute, you want island counsel, and we will say so rather than guess.
Gibraltar is a British Overseas Territory with its own regime again, currently affected by the EU treaty arrangements. We do not cover it on this page because we are not yet confident enough about the moving parts to charge for an answer.
Tell us which island you are exposed to
Say which entity sits where and we will tell you which of the three laws reaches you, and whether the Jersey cyber duties are likely to catch you in December. If the answer is that you do not need us, you will get that answer.
Checked on 2 September 2026 against the Jersey Cyber Security Centre, the Office of the Data Protection Authority in Guernsey, and the Isle of Man Information Commissioner. If a date here has moved, tell us and we will correct it.