Question to the Ministry of Justice:

To ask the Secretary of State for Justice, how many and what proportion of businesses in the UK process personal data for which registration with the Information Commissioner is required; and what estimate he has made of how much revenue is generated by businesses in the UK in each year from processing of personal data.

The Data Protection Act 1998 (DPA) requires every data controller who is processing personal information to register with the Information Commissioner’s Office (ICO) unless they are exempt. At the end of 2014/15 there were 409,000 data controllers registered with the ICO which generated a total income of £17,519,000.

The ICO is currently reviewing the coverage of the public register and plans to identify any sectors which are clearly under represented, with any such sectors being contacted by the ICO.

The ICO’s website sets out the criteria for notification and provides guidance on the level of fee organisations should be paying. The ICO have also made it easier for organisations to notify and pay the fee by introducing online payments.

The ICO’s website contains guidance for data controllers, including businesses, about their obligations under the DPA.