{"id":7120,"date":"2020-01-25T17:54:47","date_gmt":"2020-01-25T17:54:47","guid":{"rendered":"https:\/\/www.qualitycompanyformations.co.uk\/blog\/?p=7120"},"modified":"2025-01-13T09:08:12","modified_gmt":"2025-01-13T09:08:12","slug":"information-commissioners-office-ico","status":"publish","type":"post","link":"https:\/\/www.qualitycompanyformations.co.uk\/blog\/information-commissioners-office-ico\/","title":{"rendered":"What is the Information Commissioner\u2019s Office (ICO)?"},"content":{"rendered":"
The Information Commissioner’s Office (ICO) describes itself as the \u201cUK\u2019s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.<\/em>\u201d Headed up by the Information Commissioner, Elizabeth Denham (as at January 2020), the ICO deals with a variety of issues, including:<\/p>\n Some of the main pieces of legislation within the ambit of the Information Commissioner’s Office<\/a> include:<\/p>\n Although the ICO is an independent public body, it is sponsored by the Department for Digital, Culture, Media and Sport.<\/p>\n Any organisation (including limited companies and sole traders) that processes personal data is required to register with the ICO, subject to certain limited exemptions<\/a> (e.g. elected representatives, such as MPs and councillors in county councils). The ICO provides an online self-assessment tool<\/a> to help businesses and individuals ascertain whether or not they need to register.<\/p>\n The requirement to register with the Information Commissioner’s Office and pay the relevant fee (see below) is set out by Data Protection (Charges and Information) Regulations 2018<\/a> – and failure to do so will result in a fixed penalty. The ICO maintains a public register<\/a> of organisations and people who have registered, which includes:<\/p>\n In December 2019, the ICO launched a new campaign<\/a> under which they plan to write to all registered companies in the UK, reminding them of their legal responsibility to pay an annual fee if they process personal data. As a consequence, most recently formed companies can expect to be contacted by the ICO.<\/p>\n Take the stress out of filing deadlines with our Confirmation Statement Service<\/span><\/a>\n \n Fees<\/strong><\/p>\n There is an annual fee to pay upon registration, with three tiers, depending on company size and turnover:<\/p>\n The ICO has created an online fee assessment tool<\/a> to help organisations decide which tier they fall into.<\/p>\n Registration and payment need to be completed online at the same time. First time registration with the ICO<\/a> takes about 15 minutes and requires:<\/p>\n Information submitted will appear on the public register, unless specified otherwise.<\/p>\n Organisations which have previously registered will receive a reminder to renew the annual data protection registration fee<\/a>\u00a0around six weeks before it expires. The order reference and registration reference will be required to complete payment by credit or debit card. There is a fee reduction of \u00a35 if opting to pay by direct debit. See the renewal page on the ICO website<\/a>\u00a0for further information.<\/p>\n If any details (e.g. registered address) need to be changed since registration or renewal, it is possible to email or call the ICO, quoting your registration and security numbers. Further information on changing your details with the ICO can be found here<\/a>.<\/p>\n The General Data Protection Regulation (GDPR) introduced a requirement for public authorities\/bodies or companies carrying out certain types of personal data processing (e.g. large-scale online behavioural tracking or processing of data relating to criminal convictions, etc.) to appoint a\u00a0Data Protection Officer<\/a> (DPO). The role of a DPO is essentially to monitor internal compliance with data protection rules and to act as a source of advice and initial point of contact for such matters, liaising with third parties (including the ICO) where necessary.<\/p>\n To add a DPO, companies should send an email to: dataprotectionfee@ico.org.uk<\/em> with the subject line: \u2018Add a DPO\u2019 along with required details of the DPO<\/a>.<\/p>\n How to fix common mistakes made on incorporation \u00a0<\/span><\/a>\n \n The Information Commissioner’s Office deals with a wide range of complaints regarding the use of personal information by organisations, including:<\/p>\n To make a complaint relating to data protection or the (mis)use of personal information, follow the instructions on the ICO website<\/a>.<\/p>\n Enforcement powers of the ICO are set out in Part 6 of the Data Protection Act 2018<\/a> (DPA). One of the key tools at the disposal of the ICO is the power to issue fines in respect of data protection law breaches; these are known as penalty notices. The maximum limit of penalty notices was significantly increased by the GDPR from \u00a3500,000 to the higher of \u20ac20 million or 4% of global annual turnover.<\/p>\n The DPA also arms the Information Commissioner’s Office with the power to issue three other specific types of notices, namely:<\/p>\n An information notice is a formal request for a data controller, processor or individual to provide the ICO with certain information which will assist them with an investigation into a suspected compliance failure. There will be a specified time frame in which the information has to be provided. The provision of false information in connection with an information notice may lead to a criminal conviction.<\/p>\n Don\u2019t want your home address on the public record?<\/span><\/a>\n \n Under section 146 of the DPA, the ICO can issue an \u2018assessment notice\u2019 which essentially requires a data controller or processor to allow ICO representatives to conduct an investigation. This may include requiring the controller or processor to:<\/p>\n Assessment notices may be issued on the basis of \u2018urgent\u2019, \u2018no-notice\u2019 or \u2018short-notice\u2019 depending on the circumstances (e.g. if the ICO believes there is a threat of evidence being destroyed).<\/p>\n If the Information Commissioner’s Office is satisfied that an organisation has failed in its duties under data protection or information law, it can issue an enforcement notice.<\/p>\n This will specify actions which must be taken by the organisation to rectify their failings and bring it into line with the regulations – or alternatively it will require that certain actions are stopped (e.g. processing of personal information). Specific timescales will normally apply.<\/p>\n Failure to comply with information, assessment, or enforcement notices may result in a penalty notice being issued. Court action may also be taken.<\/p>\n To find out more about the enforcement powers of the Information Commissioner’s Office, see their Regulatory Action Policy<\/a>.<\/p>\n What happens after you set up a company?<\/span><\/a>\n \n"},"excerpt":{"rendered":" The Information Commissioner’s Office (ICO) describes itself as the \u201cUK\u2019s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.\u201d Headed up by the Information Commissioner, Elizabeth Denham (as at January 2020), the ICO deals with a variety of issues, including: Data protection…<\/p>\n","protected":false},"author":10,"featured_media":7109,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false},"categories":[1234],"tags":[],"class_list":["post-7120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance-legal-filings","category-1234","description-off"],"acf":[],"yoast_head":"\n\n
\n
Registering with the ICO<\/h3>\n
\n
\n
How to register with the Information Commissioner’s Office<\/h4>\n
\n
Adding a Data Protection Officer (DPO)<\/h4>\n
Making a data protection complaint<\/h3>\n
\n
What are the enforcement powers of the Information Commissioner’s Office?<\/h3>\n
Information notices<\/h4>\n
Assessment notices<\/h4>\n
\n
Enforcement notices<\/h4>\n