April 22, 2026
On 22 January 2026, the States Assembly approved the Cyber Security (Jersey) Law (the Cyber Security Law), marking one of the most significant regulatory shifts for Jersey’s digital and operational resilience in over a decade.
The law will come into force later in 2026 following Privy Council approval and introduces statutory duties for organisations designated as Operators of Essential Services (OES) across sectors including energy, water, transport, telecommunications, digital services, financial services, health, postal and courier services, food supply and public administration.
Although construction firms may not always be classified as OES, those delivering infrastructure, utilities, public facilities, digital assets, ports, hospitals, coastal defences or large scale housing will be operating within, and contracting with, OES organisations.
This introduces new contractual obligations, increased liability risk and stricter digital security requirements across the supply chain.
The Cyber Security Law establishes a statutory framework to strengthen Jersey’s cyber resilience through:
Projects involving hospitals, utilities, telecoms, infrastructure and public buildings will fall within the OES framework.
Cyber security expectations will extend across architects, engineers and contractors.
The Cyber Security Law focuses on system security, while the Data Protection Law focuses on personal data and privacy. In many cases both will apply.
Examples include:
This creates dual reporting obligations in certain cases.
Construction firms should expect the following.
Contracts must align both data protection and cyber security obligations.
Dual compliance expectations will apply across supply chains.
The Cyber Security Law represents a significant shift, elevating cyber resilience to a statutory obligation.
For construction firms, this introduces new risks and responsibilities across digital systems, contracts and supply chains.
Businesses that prepare early and integrate cyber security and data protection frameworks will be better positioned to manage risk and compete effectively in Jersey’s evolving construction market. Contact BCR Law today to start your preparations.
On 22 January 2026, the States Assembly approved the Cyber Security (Jersey) Law (the Cyber Security Law), marking one of the most significant regulatory shifts for Jersey’s digital and operational resilience in over a decade.
The law will come into force later in 2026 following Privy Council approval and introduces statutory duties for organisations designated as Operators of Essential Services (OES) across sectors including energy, water, transport, telecommunications, digital services, financial services, health, postal and courier services, food supply and public administration.
Although construction firms may not always be classified as OES, those delivering infrastructure, utilities, public facilities, digital assets, ports, hospitals, coastal defences or large scale housing will be operating within, and contracting with, OES organisations.
This introduces new contractual obligations, increased liability risk and stricter digital security requirements across the supply chain.
The Cyber Security Law establishes a statutory framework to strengthen Jersey’s cyber resilience through:
Projects involving hospitals, utilities, telecoms, infrastructure and public buildings will fall within the OES framework.
Cyber security expectations will extend across architects, engineers and contractors.
The Cyber Security Law focuses on system security, while the Data Protection Law focuses on personal data and privacy. In many cases both will apply.
Examples include:
This creates dual reporting obligations in certain cases.
Construction firms should expect the following.
Contracts must align both data protection and cyber security obligations.
Dual compliance expectations will apply across supply chains.
The Cyber Security Law represents a significant shift, elevating cyber resilience to a statutory obligation.
For construction firms, this introduces new risks and responsibilities across digital systems, contracts and supply chains.
Businesses that prepare early and integrate cyber security and data protection frameworks will be better positioned to manage risk and compete effectively in Jersey’s evolving construction market. Contact BCR Law today to start your preparations.
On 22 January 2026, the States Assembly approved the Cyber Security (Jersey) Law (the Cyber Security Law), marking one of the most significant regulatory shifts for Jersey’s digital and operational resilience in over a decade.
The law will come into force later in 2026 following Privy Council approval and introduces statutory duties for organisations designated as Operators of Essential Services (OES) across sectors including energy, water, transport, telecommunications, digital services, financial services, health, postal and courier services, food supply and public administration.
Although construction firms may not always be classified as OES, those delivering infrastructure, utilities, public facilities, digital assets, ports, hospitals, coastal defences or large scale housing will be operating within, and contracting with, OES organisations.
This introduces new contractual obligations, increased liability risk and stricter digital security requirements across the supply chain.
The Cyber Security Law establishes a statutory framework to strengthen Jersey’s cyber resilience through:
Projects involving hospitals, utilities, telecoms, infrastructure and public buildings will fall within the OES framework.
Cyber security expectations will extend across architects, engineers and contractors.
The Cyber Security Law focuses on system security, while the Data Protection Law focuses on personal data and privacy. In many cases both will apply.
Examples include:
This creates dual reporting obligations in certain cases.
Construction firms should expect the following.
Contracts must align both data protection and cyber security obligations.
Dual compliance expectations will apply across supply chains.
The Cyber Security Law represents a significant shift, elevating cyber resilience to a statutory obligation.
For construction firms, this introduces new risks and responsibilities across digital systems, contracts and supply chains.
Businesses that prepare early and integrate cyber security and data protection frameworks will be better positioned to manage risk and compete effectively in Jersey’s evolving construction market. Contact BCR Law today to start your preparations.
On 22 January 2026, the States Assembly approved the Cyber Security (Jersey) Law (the Cyber Security Law), marking one of the most significant regulatory shifts for Jersey’s digital and operational resilience in over a decade.
The law will come into force later in 2026 following Privy Council approval and introduces statutory duties for organisations designated as Operators of Essential Services (OES) across sectors including energy, water, transport, telecommunications, digital services, financial services, health, postal and courier services, food supply and public administration.
Although construction firms may not always be classified as OES, those delivering infrastructure, utilities, public facilities, digital assets, ports, hospitals, coastal defences or large scale housing will be operating within, and contracting with, OES organisations.
This introduces new contractual obligations, increased liability risk and stricter digital security requirements across the supply chain.
The Cyber Security Law establishes a statutory framework to strengthen Jersey’s cyber resilience through:
Projects involving hospitals, utilities, telecoms, infrastructure and public buildings will fall within the OES framework.
Cyber security expectations will extend across architects, engineers and contractors.
The Cyber Security Law focuses on system security, while the Data Protection Law focuses on personal data and privacy. In many cases both will apply.
Examples include:
This creates dual reporting obligations in certain cases.
Construction firms should expect the following.
Contracts must align both data protection and cyber security obligations.
Dual compliance expectations will apply across supply chains.
The Cyber Security Law represents a significant shift, elevating cyber resilience to a statutory obligation.
For construction firms, this introduces new risks and responsibilities across digital systems, contracts and supply chains.
Businesses that prepare early and integrate cyber security and data protection frameworks will be better positioned to manage risk and compete effectively in Jersey’s evolving construction market. Contact BCR Law today to start your preparations.