Guernsey’s Privacy Survey: Children’s Safety Tops Worries, and Few Can Spot AI

Small jurisdictions make good laboratories. Guernsey has roughly the population of a mid-sized town, its own data protection law and a regulator that can survey both residents and local organizations in the same season. The results its Office of the Data Protection Authority (ODPA) published on October 28, 2026 are local, but the pattern they show is not: people say they understand what personal data is, many do not know their rights, the harm they fear most online is harm to children, and artificial intelligence now sits near the top of their worries, often because they cannot tell when it is being used.

For privacy teams anywhere, the survey is a compact snapshot of what the public expects from organizations that handle their data, and where those organizations think they are doing better than they are.

First, a correction on geography and law

Some coverage has filed this survey under the United Kingdom. Guernsey is a British Crown Dependency, not part of the UK, and it has its own legislation, the Data Protection (Bailiwick of Guernsey) Law, 2017, enforced by the ODPA. The Bailiwick holds an adequacy decision from the European Commission, which means personal data can flow from the EU to Guernsey without additional transfer mechanisms. The regulator’s acronym is ODPA. None of that changes the findings, but it matters for anyone citing them in a compliance context.

What the survey found

The ODPA’s 2026 Public Survey was developed and run by research firm Hamilton Brooke and had two parts: a questionnaire for individuals and one for businesses and organizations. The regulator’s published summary does not state the number of respondents, so the percentages should be read as indicators rather than precise population estimates.

Individuals

• 91% reported at least a general understanding of what personal data is.
• 44% said they were not familiar with data protection law or their data protection rights.
• Online harm to children was the strongest concern, with 73% saying they were “very concerned,” followed by hacked accounts, online scams and fraud, information being shared without permission, and identity theft.
• 66% were concerned about how AI may use, store or process their personal data.
• Confidence in how organizations handle personal data was highest for banks and financial institutions (88%), the Guernsey Police (77%) and the health sector, and lowest for social media platforms.

Businesses and organizations

• 96% were confident that they understand and meet their responsibilities regarding personal data, and 95% were quite or very confident they understand what personal data is.
• 53% wanted practical, day-to-day compliance guidance, and 44% wanted support with new technologies including AI.
• 40% reported using AI tools.
• Keeping up with changes to data protection requirements and guidance was the most frequently identified challenge.

Speaking to the BBC, Commissioner Brent Homan said the results highlighted gaps in people’s understanding of their rights and that his office planned more support. The BBC also reported that the survey found “very few” people were confident they could recognize when AI was being used, and that a clear majority were concerned about how it was used.

Three gaps worth noticing

The confidence gap

Nearly all responding organizations say they understand and meet their obligations. Nearly half of individuals say they do not know their rights. Both can be true at once, but together they suggest that organizations are measuring compliance by their own processes rather than by whether the people they serve understand what is happening. A privacy notice that is accurate but unread does not close that gap.

The AI recognition gap

If very few people can tell when AI is involved, transparency has to be active rather than passive. That is the logic behind labeling rules for AI-generated content in the EU, which we discussed in our look at the EU code of practice on AI content transparency, and behind chatbot disclosure requirements in several U.S. states. Guernsey’s own regulator has already published practical advice, summarized in our article on the ODPA’s 10-step guide to AI and privacy.

The children gap

Online harm to children was the public’s top concern, ahead of fraud and identity theft. Most organizations do not think of themselves as child-facing, but many collect data from children incidentally through games, education tools, family accounts or social features. Our explainer on how AI uses children’s data covers the overlap between the two top concerns in this survey, and the enforcement record under the UK’s Children’s Code, which we reviewed in the Imgur fine analysis, shows what regulators look for.

A five-point response for any organization

These steps are not specific to Guernsey. They are a reasonable reaction to the public priorities the survey describes.

1. Test whether people understand your notices. Ask a small group of customers or staff to explain, in their own words, what you do with their data and how to exercise their rights. Rewrite what they get wrong.
2. Disclose AI at the point of use. Tell people when they are talking to an AI system or reading AI-generated content, in the interface, not only in a policy page.
3. Map where children’s data may enter. Even general-audience services should know whether children use them and what protections apply.
4. Make rights requests easy to start. If many people do not know their rights, the first step should be obvious: a clearly labeled link, a simple form, a plain explanation of what happens next.
5. Brief staff on AI use with personal data. With 40% of responding organizations already using AI tools, staff need to know which tools are approved and what data must not be entered into them.

For the notice side of this work, Captain Compliance offers hosted privacy notices designed to stay synchronized with the technologies a site actually runs, and data subject request workflows that route and track rights requests. These tools support clearer communication; they do not by themselves make a notice understandable, which still requires plain writing and testing. More on writing notices people actually read is in our guide to transparent privacy notices in the AI era.

Frequently asked questions

Is Guernsey covered by the UK GDPR?

No. Guernsey is a Crown Dependency with its own data protection law, the Data Protection (Bailiwick of Guernsey) Law, 2017, overseen by the ODPA. It is recognized by the European Commission as providing adequate protection for personal data.

Did 73% of people say children’s safety is the biggest online risk?

The ODPA’s summary says online harm to children was the greatest concern, with 73% of individual respondents “very concerned” about it. It was the top-ranked concern, ahead of hacked accounts, scams and identity theft.

How many people took part?

The ODPA’s public summary does not give a respondent count. The full report is published by Hamilton Brooke and linked from the ODPA’s announcement.

What will the ODPA do with the results?

The regulator says it will use them, alongside other engagement and intelligence, to shape future guidance, education and compliance work, including helping individuals understand their rights and giving organizations practical tools.

Does a survey like this have any legal effect?

No. It is not guidance or a rule. But regulators often use findings like these to set priorities, so the areas the public worries about most, children and AI, are likely to receive more attention.

The question the survey cannot answer

The Guernsey results tell us what islanders fear and what local organizations believe about themselves. They cannot tell us which of those organizations would pass a test of their own claims: whether a parent could find out what data a service holds about their child, or whether a customer could tell that the friendly reply to their complaint was written by a model. A regulator that has just learned 96% of businesses are confident may, sooner or later, decide to check.