Notification handbook
Section 2
The notification life cycle
All data controllers must notify unless they are exempt (see Section 4).
2.1 How to make an application to notify
There are currently three ways to make an application to notify.
On the internet
You can complete the notification form online, print it out and send it to us with the notification fee or your direct debit instruction.
Request for a notification form
You can complete the ‘Request for a notification form’ (see Section 6.4). This should be faxed or posted to us, marked for the attention of the Notification Department (Notification requests). Alternatively, the information can be emailed to us. The notification form will then be sent to you for further action.
By telephone
You can telephone the notification helpline on 08456 306060, or 01625 545745 if you would prefer to call a national rate number. You will be asked to provide your name, address and contact details, and to specify the nature of your business. If you request an application form via the telephone helpline or via the ‘Request for notification form’ option, a partially completed notification form will be sent to you based on the nature of your business. When you receive your form you will need to check the details on the Part 1 form, complete the relevant sections of the Part 2 form and then return both forms to us with the notification fee (£35) or your completed direct debit instruction.
2.2 What happens next?
Your form will be given a preliminary check to ensure that all the relevant information has been provided. We will write to let you know that we have received your form, we will contact you if there is a problem.
Your one-year notification period begins on the day we receive a correctly completed form and fee. If you send your form by registered post or recorded delivery, your notification period begins on the day after the day of posting.
When your notification is added to the register, we will write to you again and send you a copy of your register entry.
You will be provided with a security number which must be quoted each time you contact us about your register entry. You should keep this number safe.
2.3 Keeping your register entry up to date
Once you have notified, you must keep your register entry up to date.
When any part of your entry becomes inaccurate or incomplete, you must inform us. This action must be taken as soon as practicable and in any event within 28 days of the date on which your entry became inaccurate or incomplete. Failure to do so is a criminal offence.
Changes must be notified to us in writing (including fax or email), quoting your security number. It is not possible to request a change by telephone. Two types of change forms are available: one is for adding an additional purpose to your notification and the other is for making any other amendment to your notification. Copies are included in this handbook in Section 6.2 and are also available online.
We will write to you when your change has been actioned and will send you a copy of your amended entry. Changes can be made free of charge at any time.
See Section 2.6, which explains the position if there is a change in the legal entity of the data controller.
2.4 Renewing your register entry
The notification period is one year from the day we receive your correctly completed notification form. Your entry will then expire unless it is renewed. We will write to you before the expiry date and explain the procedure for continuing your register entry.
The fee for renewing an entry is £35 and any change to this fee will be advised to you when you start the process of renewal. Payment by direct debit is an easy way to ensure that your registration is renewed on time each year, if you pay by direct debit you will not need to take any action to renew your entry in subsequent years. A direct debit form will be enclosed with the renewal reminder letter if you have previously paid the fee by some other method.
It is very important that we receive payment of the renewal fee prior to the expiry of the entry.
At renewal time you will be asked whether there have been any changes to the data controller name and address details or the contact details.
A letter will be sent to you to confirm that your entry has been renewed, providing the new expiry date.
2.5 Removing your register entry
If notification ceases to become necessary at any time during the notification period, you should write to us with full details and your security number, and we will remove your entry from the register. We will then write to you to confirm that the entry has been removed. If you have paid by direct debit, you will need to cancel your direct debit instruction yourself.
A register entry is not transferable from one data controller to another: if there is a change in the legal entity of the data controller, a new entry must be made in the register. Examples of changes in legal entity are when a sole trader becomes a partnership or a partnership becomes a limited company. In these cases you should telephone the notification helpline, or go online to start the process of notifying.
If your previous entry is no longer required you must write in to request removal of your register entry.
2.7 Publication of the register
The data protection register is published on the internet (Data Protection Public Register). It is possible to check whether a data controller has notified and to print a copy of a register entry.