Every organisation that processes personal information has a statutory duty under the Data Protection Act 1998 to notify the Information Commissioner’s Office (ICO), unless they are exempt from so doing.
Notification involves the data controller informing the ICO of certain details about their processing of personal information. These details are used to make an entry describing the processing in the register of data controllers held by the ICO. The register is available to members of the public for inspection so that they can find out how personal information is being processed by data controllers.
From 1 October 2009 a new fee structure applies to notifications and renewals. Organisations with 250 or more members of staff and a turnover of £25.9 million or more are now required to pay a fee of £500, as are public authorities with 250 or more staff members. This higher rate does not apply to charities or small occupational pension schemes, however.
For organisations with fewer than 250 staff members and those with a turnover below £25.9 million the fee remains at £35, as previously.
It is anticipated that the two-tier fee structure will augment the ICO’s resources by approximately £4.7 million per year.
For further information, see http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/notification_fee_changes.pdf.