Received a letter from the ICO?

Many businesses have received a letter from the ICO asking for a registration fee of £40 or £60. We are constantly being asked whether or not the letter is genuine and whether a business needs to pay.

Every organisation or sole trader who processes personal information needs to pay a data protection fee to the ICO, unless they are exempt. Exemptions are rare so there is a high probability that you must pay. The law that covers this is the Data Protection (Charges and Information) Regulations 2018. Individuals and organisations that process personal data need to pay a data protection fee to the Information Commissioners Office (ICO).

From 25 May 2018, people who use CCTV for domestic purposes, i.e. to monitor their property, even if it films beyond the boundaries of their property, are exempt from paying a fee under data protection law. Businesses however do not have this exemption.

Why not take the test?

If you have received letter from the ICO and are a not for profit business or a charity, you may be exempt. We recommend you take the ICO’s test. It will only take you a few minutes and you can find the test here.

At the end of the test you will be told whether you are exempt or that you must pay. Most businesses are unlikely to be exempt. This is also a good time to consider your GDPR status.

Is this a scam?

If you have received a letter from the ICO and you are concerned it might be a scam, here is what you can do. Do NOT follow any of the links on the letter or call any of the numbers in the letter.

In the first instance, head to the ICO’s website and find the registration fee page. Complete the self-assessment and pay the fee if you are required to do so.

In reality, most businesses should have registered some time ago. A business that hasn’t registered is generally not compliant. A well thought out GDPR compliance project would have captured the need for this registration fee. If you have this letter, perhaps this is the time to consider whether you are actually compliant?

Is my Business Compliant?

Many business leaders think that a privacy notice is compliance. It isn’t. Simply having a privacy notice simply isn’t enough! A few documents that were downloaded from the web is not compliance either. Many companies simply grab templates, polices, add their name and claim compliance. Nothing could be further from the truth. It is absurd for any business leader to claim this. Now that you have received a letter from the ICO, it is time to act to understand your GDPR status.

Data classification and mapping is a must and understanding the risk of processing should be carried out before any polices and procedures are written.

Our HR person sorted it all out…

We hear this frequently. It is likely that HR clauses have been added but this isn’t compliance. There are many great HR experts around but they are not GDPR and data protection experts. There will be little risk assessment work being carried out. Simply changing wording on documents is not compliance.

We also hear that companies offering other business services do ‘a bit of GDPR’. Again, this is likely to leave holes in your compliance and unlikely to cover off new legislation. This will include the changes that have come in since Brexit and the end of the transition period.

If you are not sure of your GDPR status, we would be happy to carry out your annual audit for you. I bet you didn’t know you had to carry one out! We carry out on the spot audits also as part of our GDPR health check option.

GDPR is not a tick box, one-off, set and forget exercise. Data Protection and GDPR is a journey in the same way that your business plan continually evolves. So, if you have received a letter from the ICO, think about your overall compliance.

If you would like to know more about GDPR compliance then you can contact us on 03333 22 1011 or via our contact form. Alternatively you can book your free GDPR consultation directly with one of the team.

Don’t delay, call us today!