Your Firm and the Data Protection Act

1. Notification

Many small businesses will not need to notify the Information Commissioner, the independent body which maintains the register of data controllers. But there may be circumstances where you will need to.

1.1 Organisations which 'process' information on living people for core business purposes only are exempt from notifying.

• Processing includes obtaining, recording, retrieving, holding or destroying data. The Information Commissioner's Office says it is difficult to imagine any form of activity involving data about individuals that would not involve processing.

1.2 Organisations which 'process' information on living people for any other reason are obliged to notify.

• When you notify, you give your trading name (or legal name and any other names by which the company might be known), address and an outline of the sort of information that you hold and what you use it for.
• The information you provide goes on a public register, which anyone can consult.
• You could have a look at it, to see what type of information your suppliers, customers or rivals hold (http://www.esd.informationcommissioner.gov.uk/esd/search.asp). You can write to any organisation to ask to see a copy of any information it holds on you (see 2.5).

1.3 If you are not certain whether you should notify, seek advice.

• You can get advice from the Information Commissioner's Office's notification line (01625 545 740).
• You can find out if you need to register by completing an online questionnaire at .

1.4 Beware of data notification hustlers.

• They send out official-looking letters, or call on businesses, implying they should already be registered, and demanding payment forthwith to complete the process.
• They charge far more than the official fee for notification (currently £35 a year).
• If you get a letter like this, check whether it is genuine by ringing 08456 30 60 60. Or go to www.ico.gov.uk to check the latest list of bogus agencies.

1.5 Failure to notify when you should have done so is a criminal offence and you could well be prosecuted.

• The Information Commissioner can investigate if it suspects you haven't notified when you should have done so.