Cyber security law proposed to protect Jersey's essential services

A new law has been drafted, which would give the Jersey Cyber Security Centre formal powers and a legal mandate to issue guidance and standards.

Since it was established in 2021, JCSC has operated as a government-owned arms-length-organisation, similar to Digital Jersey or Jersey Finance.

It has never had any regulatory or enforcement powers, instead working to give advice and share best cyber security practices with Jersey businesses.

Under the proposed law, JCSC still won't be able to issue fines or warnings, but will be able to publish standards which organisations should follow.

It will also work with other authorities such as the Police, Information Commissioner and Jersey Financial Services Commission on investigations, as well as other cyber security authorities around the world.

The Jersey Cyber Security Centre office on Seaton Place

The biggest impact of the proposed law will be on organisations which are deemed to provide "essential services" for the island, including energy, transport, finance, health, water, telecoms/public communications, digital services, food production and retail.

These "Operators of Essential Services", as they are called in the draft law, will be required to take "appropriate and proportionate" security measures to identify threats, reduce risk, prepare for incidents and keep services running.

They will also have to report significant cyber incidents to JCSC within 24 hours of becoming aware of them, and have a local representative in Jersey.

Jersey's Economic Development Minister will also be able to designate an entity based outside Jersey as an "OES" if they consider the services provided essential to the island.

Under the proposed law, organisations which are considered to operate essential services could be fined up to £10,000 if they fail to comply. Anyone who provides false or misleading information to cyber security authorities could face up to five years in prison or an unlimited fine.

However, the draft law states that government services cannot be fined, but can be told to fix problems.

As the current Economic Development Minister, Deputy Kirsten Morel carries political responsibility for the island's cyber security policies. He said:

"Every sector of Jersey’s economy is increasingly digital, so every sector needs protection. Having a clearly delegated technical authority with a clear role, mandate and purpose will help us move towards a more secure digital future."

His Assistant Minister, Deputy Moz Scott, has been delegated responsibility for cyber security. She explained the impact on organisations deemed to operate essential services: "This law is a significant step in improving Jersey’s cyber resilience, in which every online user has a part to play.

"Operators of Essential Services provide the services we all rely on, including utilities, transport, communications, and food retail. This law aims to ensure these key providers take proportionate measures – including reporting significant incidents – to manage cyber incidents and help limit their impact on our island community.

"The law is being lodged concurrently with the publication of a Cyber Security Policy Framework that sets out government’s cyber policy ambition for the island in the future. The law sets out clear responsibilities and expectations that will support that ambition."

Deputies Moz Scott and Kirsten Morel signing the draft law (Image: Jersey Cyber Security Centre)

JCSC director Matt Palmer said any organisation that thinks it may be affected by the proposed law can contact them for advice.

He said: "Significant effort has gone into creating legislation that will improve the island’s cyber security position, not through regulation but through clear standards for information sharing and collaboration.

"We recognise that it’s Operators of Essential Services who will be most affected by the Cyber Security (Jersey) Law, and we will be running workshops to develop appropriate, useful guidance. These workshops will take place early in the new year, before the States Assembly debate.

"I would urge any businesses who think that they may qualify as an OES to contact JCSC so they can understand what they’ll need to do once the law comes into force."

The draft cyber security law is due to be debated in the States Assembly in early 2026, and if approved, will come into force later in the year.

You can find out more about the proposed law and which organisations would be considered as operating essential services on JCSC's website.