Requirements on data controllers2

1

A data controller must comply with the requirements of this regulation unless all of the processing of personal data they undertake is exempt processing.

2

Within the first 21 days of each charge period a data controller must pay a charge to the Information Commissioner, determined in accordance with regulation 3.

3

Within the first 21 days of each charge period a data controller must provide to the Information Commissioner the following information, as of the first day of each charge period—

a

the name and address of the data controller;

b

whether the number of members of staff of the data controller is—

i

less than or equal to 10,

ii

greater than 10 but less than or equal to 250, or

iii

greater than 250;

c

whether the turnover for the data controller's financial year is—

i

less than or equal to £632,000,

ii

greater than £632,000 but less than or equal to £36 million, or

iii

greater than £36 million; and

d

whether the data controller is a public authority.

4

Paragraph (3)(c) does not apply to a data controller that is a public authority.

5

For the purposes of paragraph (3)(a)—

a

the address of a registered company is that of its registered office, and

b

the address of a person (other than a registered company) carrying on a business is that of the person's principal place of business in the UK.

6

In this regulation—

  • “charge period” means—

    1. a

      for a person who is a data controller immediately before 25th May 2018 and has paid a fee pursuant to section 18(5) or 19(4) of the Data Protection Act 1998 M1—

      1. i

        the period of 12 months beginning on the date which is 12 months after the date on which that fee was most recently received by the Information Commissioner, and

      2. ii

        each subsequent period of 12 months;

    2. b

      for a person who is a data controller immediately before 25th May 2018 but has not paid a fee pursuant to section 18(5) or 19(4) of the Data Protection Act 1998—

      1. i

        the period of 12 months beginning on 25th May 2018, and

      2. ii

        each subsequent period of 12 months; or

    3. c

      for a person who becomes a data controller on or after 25th May 2018—

      1. i

        the period of 12 months beginning on the date on which the person becomes a data controller, and

      2. ii

        each subsequent period of 12 months;

  • “registered company” means a company registered under the Companies Acts as defined by section 2(1) of the Companies Act 2006.