WHAT IS NOTIFICATION?

• The Information Commissioner maintains a public register of data controllers
• Each register entry includes the name and address of the data controller and a general description of the processing of personal data by a data controller.
• Individuals can consult the register to find out what processing of personal data is being carried out by a particular data controller.
• Notification is the process by which a data controller's details are added to the register.

WHY DO I NEED TO NOTIFY?

The Data Protection Act 1998 requires every data controller who is processing personal data to notify unless they are exempt.

Failure to notify is a criminal offence.

DO I NEED TO NOTIFY?

• Every data controller who is processing personal data must notify unless they are exempt.
• A data controller is a person who determines the purposes for which and the manner in which any personal data are, or are to be processed.
• Personal data means data which relates to a living individual who can be identified from those data or from those data and other information which is in the possession of the data controller.

EXEMPTIONS ARE POSSIBLE FOR:

• Some not for profit organisations
• Processing of personal data for personal, family or household affairs (including recreational purposes).
• Data controllers who only process personal data for the maintenance of a public register.
• Data controllers who only process personal data for any one or all of the following purposes for their own business.
• staff administration
• advertising, marketing and public relations
• accounts and records

If you think you may be exempt click here for further information

DO I HAVE TO RENEW MY NOTIFICATION?

Yes. the notification period is one year. The renewal fee is £35. Any change to this fee will be advised to you when you start the process of renewal. We will write to you before the expiry date of your register entry.

HOW DO I RENEW MY REGISTER ENTRY?

The notification period is one year from the day we receive your correctly completed notification form. Your entry will then expire unless it is renewed. Prior to the expiry date we will write to you and explain the procedure for continuing your register entry.

The fee for renewing an entry is £35. Any change to this fee will be advised to you when you start the process of renewal. If you pay by direct debit you will not need to take any action to renew your entry in subsequent years. If you have previously paid the fee by some other method a direct debit form will be enclosed with the renewal reminder letter.

At renewal time you will be asked. whether there have been any changes to the data controller name and address details of the contact details.

A letter will be sent to you to confirm that your entry has been renewed together with information about your new expiry date.

WHAT DO I DO IF MY NOTIFICATION HAS EXPIRED?

It is very important that we receive payment of the renewal fee prior to the expiry of the entry. It is not possible to renew an entry which has expired. In these circumstances the data controller must make a new application for notification.

COMPLETING THE NOTIFICATION FORM ON THE INTERNET

It is possible to complete the notification form using the Internet. However, after completing the form on-line it must be printed and sent to us by post with the notification fee or direct debit instruction. Currently it is not possible to send the form to us electronically. You will be deemed notified on the day we receive your correctly completed forms and fee.

Completing the notification form on-line is a step-by-step process. You are asked to answer certain questions and provide information before continuing onto the next question. At the end of the form you can print it off and send it to us.

The first questions on the form are about the data controller who is notifying, for example their name, address and contact details.

The next stage of the online process involves choosing an appropriate nature of business template. Each notification must include a general description of the processing of personal data being carried out. On the register this description is structured by reference to purposes. You will find a selection of templates which describe the processing which is likely to be being carried out by a range of different businesses. After selecting the template appropriate to your business you need to check that it accurately describes the processing which is being carried out. You may amend the template or add additional purposes to it. If you cannot find a relevant template, either call the notification help line or select the nearest template suitable to your needs and amend it accordingly.

The following stage of the on line process involves providing additional information for example, the security statement and statement of exempt processing. Some of this information is mandatory, so failure to return this part of the form renders your Notification invalid and it will be returned to you.

The final stage is to print the form, sign the declaration and return it to us with the notification fee or completed direct debit instruction. If after printing the form you find that you have forgotten to include something, then you can write in ink directly onto the form and we will include it in your notification.

MANUAL RECORDS AND NOTIFICATION

There is no requirement to notify manual records which come within the scope of the Data Protection Act 1998.

However, you can choose to notify them voluntarily. Further information about manual records can be found in our publication The Data Protection Act 1998 An Introduction.

HOW DO I NOTIFY?

There are 3 easy ways to notify:

• By Internet

  You can complete the notification form on-line, print it and send the form to us.

• By Telephone

  You can telephone the notification help line (01625 545 740) and a draft notification form will be sent to you based on the information you will be asked to provide on the telephone.

• By completing the Request for a Notification Form

  This form can be found on our Home page

Click Here To Notify Online

SCHOOLS IN ENGLAND, WALES AND NORTHERN IRELAND (HEADTEACHERS AND GOVERNING BODIES) WHO WERE REGISTERED UNDER THE 1984 ACT

A single notification may be made in the name of the school

Most schools currently have two register entries in the name of the Headteacher and the Governing Body. These entries may expire at different times.

HOW TO MOVE TO A SINGLE REGISTER ENTRY

If you are notifying in the name of the school, only one notification should be made at the time when the first entry expires.

(We need to know the registration numbers of the two entries (Headteacher and Governing Body). Upon receipt of a properly completed notification form in the name of the school we will remove both the 1984 entries in the name of the Headteacher and the Governing Body.)

GUIDANCE FOR DATA CONTROLLERS & COMPUTER BUREAUX WHO HAVE BEEN REGISTERED UNDER THE 1984 ACT

• Notification is required (unless you are exempt) when your 1984 register entry expires.
• Computer Bureaux (called data processors under the 1998 Act) are not required to notify
• A notification under the 1998 Data Protection Act will supersede any existing registration made under The 1984 Data Protection Act, even if the existing registration has yet to expire.
• You will either be;
  • Sent a letter which invites you to telephone us to start the notification process or to use the internet to complete the notification form.
  
  or
  • You will be sent a templated notification form based on your nature of business.

DATA CONTROLLERS WHO HAD MORE THAN ONE 1984 REGISTER ENTRY

• Under the 1998 Act each data controller can only have one register entry.
• As a data controller with more than one entry you have a number of choices about when to notify:
• You can choose to notify at any time before your last entry expires. When you notify, all your remaining 1984 entries will be removed from the register. This is why we ask you to provide a list of all previous registration numbers.
• You can wait until your last entry is due to expire and then notify. After 1 March 2000 you cannot renew any entries which expire before your last entry. These entries will lapse on their expiry date and you will receive confirmation of their expired status.
• If you decide to wait until your last entry expires you must make arrangements to amend or amalgamate your remaining entry or entries to ensure that all the processing of personal data which you are processing are covered. Details of any changes should be sent to us in writing.

THE CHANGES INTRODUCED BY NOTIFICATION

Notification replaces the registration system established by the 1984 Data Protection Act.

Below is a summary of the main differences:

• Broadly speaking data users become data controllers.
• Broadly speaking computer bureaux become data processors and do not need to notify.
• Register entries will still contain a description of the processing of personal data. However, this description is in very general terms. The detailed coding system no longer exists.
• You do not need to describe sources of personal data in your entry.
• Registration of disclosures are replaced by notification of recipients.
• You need to describe transfers of personal data outside the EEA only.
• You have to provide a statement about your security measures.
• You do not have to provide an address for the receipt of subject access requests.
• The 1998 Act provides some exemptions from notification but you can choose to notify voluntarily.
• The notification period is one year.
• A data controller can only have one register entry.
• Headteachers and Governing Bodies of schools may notify in the name of the school.

NOTIFICATION FEE

• Every notification must be accompanied by a fee of £35.00 (VAT nil)
• The period of notification is one year. We do not send invoices but will acknowledge receipt of payment. After this time a continuation fee of £35.00 must be paid.

It is possible to pay by direct debit, cheque or BACS

• By Direct Debit
  Completion of a direct debit form is part of the notification process.

• By Cheque
  Please make the cheque payable to the Information Commissioner and crossed A/c Payee only. Please write your reference number on the back of your cheque.

• By BACS
  Please ensure that you provide your reference number when submitting your BACS payment.