Comply with data protection legislation

Notifying the Information Commissioner

The Data Protection Act 1998 requires data controllers to give details about their processing of personal information to the Information Commissioner for inclusion in a public register, unless they are exempt. This is so that people can find out what personal information a data controller is processing and why they are doing so.

If you are a data controller and you process personal information, you will need to find out whether you are required to notify the Information Commissioner for inclusion in the public register.

Some processing purposes about which a data controller must notify the Information Commissioner include:

• credit referencing
• pensions administration
• debt factoring

Even if you are not required to notify, you must always ensure that you comply with the eight principles of the Data Protection Act.

Notification process
The details to be notified are:

• name and address of the data controller or their representative
• description of the information being processed
• purpose of processing the information
• those to whom the information will be or may be disclosed
• countries outside the European Economic Area (the EU plus Norway, Iceland and Liechtenstein) where data may be transferred
• certain details on information security measures

Read a short guide to notification for data protection from the Information Commissioner website.

Notification can be initiated by calling the Information Commissioner Notification Line on Tel 01625 545 740 or by completing and posting a notification form.

The period of notification is one year. Notifications must be renewed annually. There is an annual fee of £35.

Changes to a notification entry must be notified as soon as possible. Changes are made free of charge.

Bogus agencies
Businesses throughout the UK continue to be troubled by bogus data protection notification agencies. The Information Commissioner is the only statutory authority for administering and maintaining the public register of data controllers. See our page in this guide on bogus data protection agencies.

Subjects covered in this guide

• Introduction
• The Information Commissioner
• The Data Protection Act
• The eight principles
• Notifying the Information Commissioner
• Exemptions from notifying the Information Commissioner
• Rights of access
• Monitoring employees
• Enforcement and penalties
• Bogus data protection agencies
• Here's how I complied with the Data Protection Act 1998

 Print This Page

Source - Business Link; Crown Copyright.