Comply with data protection legislation

Exemptions from notifying the Information Commissioner

The Data Protection Act 1998 requires data controllers to notify the Information Commissioner unless they are exempt from having to do so.

Exemptions from notification are possible for data controllers who only process personal information, subject to certain conditions, for the following purposes:

• staff administration (including payroll)
• advertising, marketing and public relations for their own business
• accounts and records

If you only hold manual records then you will also be exempt from the requirement to notify.

Matters to note about exemption
Even if you are exempt from notification you must still comply with other provisions in the Act, including the eight principles. See the page in this guide on the eight principles.

Be aware that if the information you process and how you process it changes you may no longer be exempt from the requirement to notify. If you have already notified the Information Commissioner then changes to your processing may mean that your notification is not up-to-date. Make sure that you have a way of monitoring your information processing to identify any such changes.

There is no need to inform the Information Commissioner if you decide you are exempt. If a data controller is exempt they can still choose to notify if they wish.

Subjects covered in this guide

• Introduction
• The Information Commissioner
• The Data Protection Act
• The eight principles
• Notifying the Information Commissioner
• Exemptions from notifying the Information Commissioner
• Rights of access
• Monitoring employees
• Enforcement and penalties
• Bogus data protection agencies
• Here's how I complied with the Data Protection Act 1998