Skip to content
World Watch

Cybersecurity law & regulation in Jersey (2026)

Cybersecurity in Jersey: comprehensive law.

Jersey's States Assembly unanimously enacted the Cyber Security (Jersey) Law on 22 January 2026, the island's first standalone cybersecurity statute, establishing the JCSC as the national cybersecurity authority and imposing mandatory obligations on Operators of Essential Services (OES) across ten sectors. The law awaits Privy Council approval before commencement, expected in summer 2026. Pre-existing JFSC Codes of Practice already impose proportionate cyber risk-management duties on all registered financial-services firms.

Last verified Official sources first · MethodologyCompare Jersey with other countries

Legal framework

Cyber Security (Jersey) Law 202- (passed by States Assembly 22 January 2026, pending Privy Council assent, commencement expected summer 2026); Jersey Cyber Security Centre (JCSC) as national authority; Jersey Financial Services Commission (JFSC) Codes of Practice for registered financial-services firms

Key points: cybersecurity in Jersey

  1. Comprehensive cyber law enacted

    The Cyber Security (Jersey) Law 202- was approved unanimously by the States Assembly on 22 January 2026. It is Jersey's first dedicated cybersecurity statute and awaits Privy Council approval before formal commencement, expected summer 2026.

    statesassembly.je statesassembly.je

  2. JCSC as statutory national authority

    The Law grants statutory status to the Jersey Cyber Security Centre (JCSC), creating an operationally independent Director role appointed by the Minister for Sustainable Economic Development, Technical Advisory Councils (TACs), and formalises the JCSC as Jersey's CSIRT and Single Point of Contact (SPOC).

    jcsc.je jcsc.je

  3. Operators of Essential Services (OES)

    Entities across ten sectors, energy, water, transport, food, postal, health, telecoms, digital, financial services, and public administration, that meet sector-specific thresholds must register with JCSC and implement proportionate, risk-based cybersecurity measures.

    statesassembly.je jcsc.je

  4. Mandatory 24-hour incident reporting

    OES must report significant cyber incidents to JCSC within 24 hours of becoming aware that an incident qualifies as significant. Non-compliance carries civil penalties of up to £10,000; providing false or misleading information attracts criminal sanctions.

    jcsc.je statesassembly.je

  5. JFSC sectoral cyber obligations (pre-existing)

    Independent of the new law, the JFSC's Codes of Practice require all registered persons to document and proportionately mitigate cyber risks and to notify the JFSC of any incident that could materially affect their registration or client interests.

    jerseyfsc.org jerseyfsc.org

  6. Data Protection breach notification (parallel regime)

    The Data Protection (Jersey) Law 2018 separately requires all organisations to notify the Jersey Office of the Information Commissioner in writing of personal data breaches, operating alongside the new OES incident-reporting regime.

    gov.je jcsc.je

Sources

  1. statesassembly.je/publications/propositions/2025/p-107-2025
  2. statesassembly.je/publications/hansard/2026/official-report-22nd-january-2026
  3. jcsc.je/about-jersey-cyber-security-centre/cyber-security-jersey-law-informat
  4. jcsc.je/latest/news/law-lodged-to-improve-jerseys-cyber-security/
  5. jcsc.je/about-jersey-cyber-security-centre/cyber-security-jersey-law/
  6. jerseyfsc.org/industry/risk/cyber-security/understanding-your-regulatory-obligation
  7. jerseyfsc.org/industry/risk/cyber-security/
  8. gov.je/Government/Consultations/pages/cybersecurity.aspx
  9. gov.je/SiteCollectionDocuments/Industry%20and%20finance/L%20Draft%20Cyber%20

Next for Jersey: Starting a BusinessEasy

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026