Notification is a statutory requirement and every organisation that processes personal information must notify the Information Commissioner’s Office (ICO), unless they are exempt. Failure to notify is a criminal offence.
Notification is the process by which a data controller gives the ICO details about their processing of personal information. The ICO publishes certain details in the register of data controllers
, which is available to the public for inspection.
To change an existing entry or to add a purpose, see keeping your register entry up to date. For further information, see the links at the right-hand side of this page.
Making an application to notify (new notifications)
Before making your application, please check the register of data controllers
to ensure you are not already registered.
Important:
Changes to the notification fee structure came into effect on 1 October 2009. The fee structure is now tiered to reflect the costs to the ICO of regulating data controllers of different sizes.
Data controllers are now required to assess which fee tier they fall within and the fee they are required to pay for notification. For more details on the new fee structure, click here.
There are three ways to make an application to notify
-
On the internet
You can complete the notification form online, print it out and send it to us. You must include the notification fee or your direct debit instruction (see the ‘Ways to pay’ section below). Note about our logo: We are phasing in a new logo across our website and publications. Please bear with us as our online notification form continues to carry the old logo. Our address is:
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
-
Request for a notification form
You can complete the request for a notification form. This should be posted to us, marked for the attention of the Notification Department (Notification requests). Alternatively, you can send us the form by email (notification@ico.gsi.gov.uk) or by fax. We will send you a notification form for further action.
-
By telephone
You can telephone the notification helpline on 01625 545740 between the hours of 9.00am and 5.00pm, Monday to Friday. You will be asked to provide your name, address and contact details, and to specify the nature of your business. We will send a notification form to you.
If you request an application form via the telephone helpline or via the ‘Request for a notification form’ option, a partially completed notification form will be sent to you based on the nature of your business. When you receive your form you will need to check the details in Part 1, complete the relevant sections of Part 2 then return parts to us with the notification fee or direct debit instruction.
There is a two-tiered notification fee. The two-tiered structure is based on an organisation’s size and turnover. A data controller will need to assess which tier they fall in and hence the fee they are required to pay. The fee for tier 1 is £35 and the fee for tier 2 is £500. We do not send invoices but will acknowledge receipt of payment if requested. The period of notification is one year, after which time you will need to renew your notification. More information on tiered fees can be found in our guide ‘Notification Fee Changes – what you need to know’.
Payment methods:
By cheque or postal order
Cheques for the relevant fee should be made payable to ‘The Information Commissioner’ and crossed ‘A/C Payee only’. Please write your registration number on the back of the cheque.
By direct debit
A direct debit form will be sent to you in your notification pack. Alternatively, you can print a direct debit form from our website. We will acknowledge receipt of your direct debit instruction and advise you of the date on which the fee will be collected from your bank account. However, we regret that due to constraints on our current system, we are unable to process tier 2 payments by direct debit.
The name you provide must be the correct legal title of the individual or organisation. Examples are given below.
-
Sole traders - provide the full name of the individual, eg Anna Katherine Smith.
-
Partnerships - provide the trading name of the firm, eg Butterfield & Co. (you do not have to provide the name of the partners).
-
Limited or public limited companies - provide the full name of the company, eg ABC Limited (not your trading name).
-
Groups of companies - groups of companies cannot submit a single notification. Individual companies who are data controllers must notify separately.
-
Schools - provide the name of the school, eg Hazeldown School.
-
Others, eg voluntary bodies - provide the name by which you are known to the public.
If you are a limited company, you must provide your registered office address, and in all other cases, you must provide the address of your principal place of business. If there is no place of business (eg for a small local voluntary body), you should provide the address of the official who has completed the form.
Only one notification is required per legal entity. This will cover any number of different branches or addresses where the data is processed.
For full information about the notification process, please choose one of the following:
Notification handbook (HTML)
Notification handbook (PDF)
.