Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Register of data controllers
open-in-new
<h2 id="data-protection-act-1998">Data Protection Act 1998</h2> <p>Under the 1998 Act, the name of the data controller was recorded <a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> with the purpose(s) for the processing of the data processed by that controller within the meaning of the Act.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a><a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a><a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p><p>The 1998 Act established a distinction between data controllers and data processors, to whom distinct legal and governance obligations applied:<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> data controllers determined the purposes for which personal data was held or processed, whereas data process data on behalf of another data controller.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a>: Section 1(1) </p><p>A data controller may, under some circumstances, be exempt from registration (previously termed <i>notification</i>).<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> When not exempt,<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> failure to notify the Information Commissioner's Office formally before the start of processing data was a <a href="/facts/Strict_liability_(criminal)/jok0Y8Gq">strict liability offence</a> for which a prosecution may be brought by the Information Commissioner's Office in the criminal court of the UK.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> Failure to notify was a criminal offence unless exempt. Exemption from registration does not exempt a data controller from compliance with The Act. </p><p>Amendments to a data controller's notification could be made at any time, and must have been made before the start of a new processing purpose. </p> <h2 id="data-protection-act-2018">Data Protection Act 2018</h2> <p>Under the 2018 Act, the register is called the register of fee payers, and the purposes for processing are nor supplied, though other trading names and the name of a Data Protection Officer may be given.<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a> The distinction between data controllers and data processors remains in place.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a> As of July 2024<a href="https://en.wikipedia.org/w/index.php?title=Register_of_data_controllers&action=edit">[update]</a> the ICO reports that there are over one million registered fee payers.<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> </p><p>The enforcement of the Act by the <a href="/facts/Information_Commissioner%2527s_Office/NPBgoq90">Information Commissioner's Office</a> is supported by a data protection charge on UK data controllers under the Data Protection (Charges and Information) Regulations 2018. Exemptions from the charge were left broadly the same as for 1998 Act: largely some businesses and non-profits internal core purposes (staff or members, marketing and accounting), household affairs, some public purposes, and non-automated processing.<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a><a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a> Under the 2018 Act, the enforcement regime for registration changed from criminal to civil monetary penalties.<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/General_Data_Protection_Regulation/RMLY6ohr">General Data Protection Regulation#United Kingdom implementation</a></li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/">Register of fee payers</a>, at which any entry may be inspected at no charge.</li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>UK Legislation, Data Protection Act 1998, accessed 15 January 2024 <a href="https://www.legislation.gov.uk/ukpga/1998/29/section/19/enacted" target="_blank">https://www.legislation.gov.uk/ukpga/1998/29/section/19/enacted</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"Register of data controllers". UK Information Commissioner's Office. Archived from the original on 17 March 2015. Retrieved 2015-07-16. We publish the name and address of these data controllers, as well as a description of the kind of processing they do. <a href="https://web.archive.org/web/20150317044857/https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/" target="_blank">https://web.archive.org/web/20150317044857/https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"Data Protection Act 1998 - Part 1, Basic Interpretive Provisions - Section 1". Office of Public Sector Information. Retrieved 2009-11-18. 'data controller' means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed; <a href="http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_2#pt1-l1g1" target="_blank">http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_2#pt1-l1g1</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"Register of data controllers". UK Information Commissioner's Office. Archived from the original on 17 March 2015. Retrieved 2015-07-16. We publish the name and address of these data controllers, as well as a description of the kind of processing they do. <a href="https://web.archive.org/web/20150317044857/https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/" target="_blank">https://web.archive.org/web/20150317044857/https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"Register of Data Controllers". The Advertising Protection Agency. Archived from the original on 7 January 2011. Retrieved 22 March 2012. The ICO then publishes certain details from the registration data in the register of data controllers which is available to the public for inspection. <a href="https://web.archive.org/web/20110107040423/http://www.theadvertisingprotectionagency.co.uk/register-of-data-controllers.php" target="_blank">https://web.archive.org/web/20110107040423/http://www.theadvertisingprotectionagency.co.uk/register-of-data-controllers.php</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>"Notifying the Information Commissioner's Office about personal information". Business Link. Retrieved 22 March 2012. The Data Protection Act 1998 requires businesses to give details about the way they process personal information to the Information Commissioner's Office (ICO) for inclusion in a public register, unless they are exempt. This is called notification. <a href="http://www.businesslink.gov.uk/bdotg/action/detail?itemId=1074415109&type=RESOURCES" target="_blank">http://www.businesslink.gov.uk/bdotg/action/detail?itemId=1074415109&type=RESOURCES</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Information Commissioner's Office, Data controllers and data processors: what the difference is and what the governance implications are, published 2014, archived on 16 May 2015, accessed on 15 July 2024 <a href="https://web.archive.org/web/20150417053411/https://ico.org.uk/for-organisations/guidance-index/data-protection-and-privacy-and-electronic-communications/" target="_blank">https://web.archive.org/web/20150417053411/https://ico.org.uk/for-organisations/guidance-index/data-protection-and-privacy-and-electronic-communications/</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>UK Legislation, Data Protection Act 1998, accessed 15 January 2024 <a href="https://www.legislation.gov.uk/ukpga/1998/29/section/19/enacted" target="_blank">https://www.legislation.gov.uk/ukpga/1998/29/section/19/enacted</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"Register (notify) under the Data Protection Act". UK Information Commissioner's Office. Retrieved 2015-07-16. The Data Protection Act 1998 requires every data controller (eg organisation, sole trader) who is processing personal information to register with the ICO, unless they are exempt. <a href="https://ico.org.uk/for-organisations/register/" target="_blank">https://ico.org.uk/for-organisations/register/</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>"In brief – are there any exemptions from the Data Protection Act?". UK Information Commissioner's Office. Archived from the original on 16 July 2015. Retrieved 16 July 2015. ... there are some exemptions from the Act to accommodate special circumstances. <a href="https://web.archive.org/web/20150716235000/https://ico.org.uk/for-organisations/guide-to-data-protection/exemptions/" target="_blank">https://web.archive.org/web/20150716235000/https://ico.org.uk/for-organisations/guide-to-data-protection/exemptions/</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"Register of Data Controllers - University of Strathclyde". University of Strathclyde. Retrieved 22 March 2012. Every organisation that processes, i.e. holds and uses, personal information must be registered with the UK Information Commissioner's Office (ICO), unless they are exempt. This registration is a statutory requirement under the Data Protection Act and failure to notify the ICO is a criminal offence. <a href="http://www.strath.ac.uk/dataprotection/registerofdatacontrollers/" target="_blank">http://www.strath.ac.uk/dataprotection/registerofdatacontrollers/</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>"Register of fee payers". Information Commissioner’s Office. Retrieved 1 May 2020. <a href="https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/" target="_blank">https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"Add a Data Protection Officer". Information Commissioner’s Office. Retrieved 1 May 2020. <a href="https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/" target="_blank">https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>"A guide to controllers and processors". Information Commissioner’s Office. 19 May 2023. Retrieved 15 July 2024. <a href="https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors-a-guide/" target="_blank">https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors-a-guide/</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>"Register of fee payers". Information Commissioner’s Office. Retrieved 1 May 2020. <a href="https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/" target="_blank">https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>Review of exemptions from paying charges to the Information Commissioner's Office (PDF) (Report). Department for Digital, Culture, Media and Sport. November 2018. Retrieved 30 April 2020. <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/754690/Government_response_to_the_ICO_Charge_Exemption_Consultation_L.pdf" target="_blank">https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/754690/Government_response_to_the_ICO_Charge_Exemption_Consultation_L.pdf</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>"The Data Protection (Charges and Information) Regulations 2018 - Schedule Exempt Processing". legislation.gov.uk. Retrieved 30 April 2020. <a href="https://www.legislation.gov.uk/ukdsi/2018/9780111165782/schedule" target="_blank">https://www.legislation.gov.uk/ukdsi/2018/9780111165782/schedule</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>"ICO issues the first fines to organisations that have not paid the data protection fee". Information Commissioner’s Office. 28 November 2018. Retrieved 1 May 2020. <a href="https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/11/ico-issues-the-first-fines-to-organisations-that-have-not-paid-the-data-protection-fee/" target="_blank">https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/11/ico-issues-the-first-fines-to-organisations-that-have-not-paid-the-data-protection-fee/</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> </ol>