Should My Business Register With The ICO?

Every sole trader, business or organisation that processes personal data must register with the Information Commissioner’s Office (“ICO”). Failing to register may lead to the imposition of a fine. The ICO keeps a public list of organisations that have received a penalty notice for not paying the fee. It is therefore essential that you can correctly identify whether your business needs to register.

What businesses are exempt from registering with the ICO?

There are a number of exemptions which only apply in very specific circumstances. If your business can rely on an exemption, it will not need to register with the ICO. Your business would be exempt if it is processing personal data purely for one (or more) of the following purposes:

• staff administration (including to run your organisation’s payroll);
• advertising, marketing and public relations in connection with your own business;
• accounts and records (such as invoices or payments);
• personal, family or household affairs;
• performing judicial functions;
• performing elected representative functions;
• maintaining a public register; and
• processing personal information without an automated system such as a computer.

Many businesses, however, process personal data for other purposes (or in addition to) those listed above, which suggests that they may not be able to rely on an exemption from registration.

For example, if a business records and updates its staff’s personal data for the purposes of staff administration and managing its own accounts, then it may be exempt from registering with the ICO. However, if this same business also collects personal data from job applicants for recruitment purposes, it will no longer be able to rely on an exemption from registration.

Similarly, if a business collects personal data from its customers for advertising and marketing its own goods or services, then it may be exempt from registering with the ICO. However, if this same business also uses customer personal data to deliver goods or perform a service for its customers, it will not be able to rely on an exemption from registration.

For example:

• An online retail business will need to collect and use a customer’s name and address to deliver ordered goods.
• A healthcare professional will need to record and analyse medical data of their patients in order to provide appropriate advice and support to them.

How we can help

We offer a complimentary service to help determine whether your business or organisation is required to register with the ICO.

If your business or organisation is required to register with the ICO, our ICO Registration service can help you understand the requirements and complete the registration process.