We have received what looks like an official looking letter saying that we need to be registered because we process data. The letter confirms that there is a charge of £185 to register.

Do we need to be registered?  And should we pay the requested amount?
The requirement to register with the Information Commission is created by the Data Protection Act 1998, ‘the Act, note that data protection laws are currently being reviewed and are likely to change read here. The Act applies to firms holding information about living individuals in electronic format and, in some cases, on paper. Companies that process personal data must follow the eight data protection principles of good information handling.

These say that personal information must be:

  1. fairly and lawfully processed;
  2. processed for specified purposes;
  3. adequate, relevant and not excessive;
  4. accurate and, where necessary, kept up to date;
  5. not kept for longer than is necessary;
  6. processed in line with the rights of the individual;
  7. kept secure; and
  8. not transferred to countries outside the European Economic Area unless the information is adequately protected.


Do you need to be registered?

You may need to register with the Information Commission if you process Personal Data.

Personal data means data which relates to a living individual who can be identified –
(a) from the data, or
(b) from data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

The quickest way to decide whether you need to register is to use the Information Commission’s self assessment tool, which is on their website. If you are not registered, and you are not sure whether you should register click here to go to their site.

Should you pay £185 to register?

Definitely not, there has been a ‘scam’ relating to the legal requirement to register with the Information Commission for many years. Companies write to you with what looks like an official Information ‘Commission’ type organisation. The letter reminds you of the legal requirement to register and may even tell you that you are breaking the law and acting criminally because you are not registered and could be liable for up to a £10,000 fine.

If after you have undertaken the assessment you believe you should be registered then register. The standard fee to register with the Information Commission is £35.

The company that has contacted you will simply fill in the forms and charge you £150 to complete the forms, the remainder of their fee £35 will be used to pay the registration fee.

If you are unsure whether the company has already registered in the past then search the register by clicking here.

If you need help completing the forms and are a member of the RML subscription service then contact the helpline.