The number of data protection complaints and inquiries received in Jersey rose sharply in 2025, while organisations reported 209 self-reported data breaches during the year.
The Jersey Office of the Information Commissioner (JOIC) recorded 135 complaints and inquiries in 2025, compared with 86 in 2024, while the number of self-reported data breaches increased from 184 to 209.
Half of the complaints received related to people seeking access to their personal information, while 21% concerned the unauthorised disclosure of personal data and 12% related to requests for information to be rectified, erased or transferred.
Of the complaints closed during the year, 27% were investigated and resulted in a breach determination, while 10% were investigated and resulted in no breach being found. A further 57% were not investigated under the provisions of the Data Protection Authority (Jersey) Law 2018 and 6% were withdrawn.
Unauthorised disclosure remained the most common type of self-reported breach, accounting for 146 of the 209 incidents recorded during 2025. A further 54 involved unauthorised access.
The figures are contained in JOIC’s 2025 Annual Report, which also shows that the number of organisations registered for data protection purposes has increased by 46% since 2020. There were 8,355 registered organisations in 2025.
The regulator also continued its education and outreach work during the year. Its Let’s Go DPO network grew from 181 to 326 members, while weekly Data Protection Express clinics were introduced for sole traders, small businesses and start-ups.
JOIC engaged with 1,882 young people across ten secondary schools and further education establishments through its privacy programme. Of those providing feedback, 97% said their knowledge of JOIC, protecting their personal information and understanding their individual rights had improved.
The annual report also sets out the Jersey Data Protection Authority’s priorities for 2026 to 2028, with children’s privacy, artificial intelligence and cyber security identified as its three main areas of focus.
Its work on AI will initially focus on its use in human resources and employment, including automated recruitment tools, performance analytics and workforce management systems. The regulator said organisations should consider issues including bias, accountability, explainability and meaningful human oversight when using AI systems.
Cyber security has also been identified as a board-level priority, with the report stating that cyber and data breaches are becoming more sophisticated and frequent.
Separately, JOIC’s annual report on Freedom of Information activity shows that Jersey’s Scheduled Public Authorities received and responded to 1,093 valid FOI requests during 2025. Thirteen generated appeals to the Information Commissioner, representing less than 1.19% of the total.
The Information Commissioner also highlighted recurring issues including delays in responding to requests, inadequate searches for information and the incorrect or overly broad use of exemptions.
Elizabeth Denham CBE, Chair of the Jersey Data Protection Authority, said: “Data protection is ultimately about trust. The technological opportunities before us – in artificial intelligence, in data-driven innovation, in the digital economy – will only be realised where people trust that their data will be used fairly, transparently, and with respect for their dignity and rights.”
