ICO demand – is it a scam?

ICO demand – is it a scam?

9:52 AM, 10th December 2019, About 2 years ago 83

Text Size

Our Ltd company has just received a demand from ICO (Information Commissioner’s Office) claiming that we are not registered with them. That is true…. I have never heard of or from them before.

They say our customers, clients and tenants expect us to take our data protection obligations seriously like the many real estate companies that have paid their fee on time. If we have not paid a data protection fee to ICO we could be liable to pay fines of up to £4000.

In former times we did take personal details from our, mainly student, tenants….names, addresses ,telephone numbers, college details etc. Nowadays however we use agents and although, if we wanted, we could have copies of all tenancy agreements we normally leave all that with the agents.

As we do not hold these details I think the rules (if there are such rules) do not apply to us directly, but might apply to our agents. But something about this demand smells of a scam.

How come we have never heard of this before? Has anybody else received a similar demand?


Editors Note:

ICO blog 03/12/2019 >> Click here

We have launched a campaign to contact all registered companies in the UK reminding them of their legal responsibility to pay a data protection fee. The move marks the start of an extensive programme to make sure the Data Protection Fee is paid by all those who need to pay it.

Under the Data Protection Act 2018 organisations processing personal information are required to pay a data protection fee unless they are exempt. You can quickly and easily find out if your organisation needs to pay the fee by using our self-assessment checker, but if you hold personal information for business purposes on any electronic device, including using CCTV for crime prevention purposes, it is likely an annual fee payment is due.

You can avoid us needing to contact you by either:

  1. Visiting our website to pay your organisation’s Data Protection Fee online
  2. Completing this form to tell us why your organisation is exempt from paying the fee.

Since the new annual data protection fee was introduced in May 2018, over 600,000 organisations have registered to pay it. They have gone on to access the range of services and support we provide to help them to comply with the law and give their customers, clients and suppliers trust and confidence in the way they process personal information. At the same time, between 1 July and 30 September 2019, we issued 340 monetary penalties to organisations that have not paid the Data Protection Fee.

As well as naming most organisations we need to fine, we also publish the names of all fee-paying organisations. This helps them make it clear to their customers, clients and suppliers that they are aware of their legal obligations when processing personal information.

We know data protection legislation can be complicated and we are here to help. The reminders we are sending to organisations are to help make it easy to comply with the law as well as access a great deal of advice and support available from the ICO. This includes:

  • a Helpline and Live Chat service dedicated to supporting small businesses and organisations;
  • a series of self-assessment tools and products on our website;
  • advisory visits and support designed to help small businesses and organisations to comply with the law.

The cost of the data protection fee depends on a company’s size and turnover. There are three tiers of fee ranging from £40 and £2,900, but for most organisations it will be £40 or £60. The cost is reduced by £5 if you sign up by direct debit and you can find out how much you need to pay by taking a self-assessment.

For further help and advice, call the ICO’s small business helpline on 0303 123 1113 between 9am – 5pm, Monday to Friday (excluding Bank Holidays).


by Neil Patterson

10:01 AM, 10th December 2019, About 2 years ago

Hi Nick,

Please see my editors note in the article containing the ICO blog indicating they are chasing all registered companies.

by Ian Narbeth

10:03 AM, 10th December 2019, About 2 years ago

Dear Nick
Please spend some time, say 45 seconds, Googling Information Commissioner’s Office and data protection. First hit: https://ico.org.uk/for-organisations/data-protection-fee/
If you don't know whether or not you need to register, you need to find out PDQ.

PS It's not a scam.
PPS Neil beat me to it.

by Chris Clare

11:43 AM, 11th December 2019, About 2 years ago

Whilst this particular letter which is being sent out is indeed not a scam. It is worth noting that the manner in which the ICO has decided to carry out this project does leave the consumer open to scams.

This letter is a little non personal and whilst it is printed on ICO letterhead that is not hard to fake, which is also the same for the method of resolution and payment.

It is my opinion that as soon as a fraudster realises that these letters are being issued they will jump on the bandwagon and start doing their own, trying to manipulate individuals into sending money to their own accounts. So be vigilant, just because this one is genuine does not mean any future ones will be.

The tip I would give for any of these letters is ignore what is on it and visit the ICO website directly by typing in ICO.org.uk or following the links in Nick's post above.

Above all never go to links in unsolicited, emails, texts or letters as these could be manipulated links from a fraudster.

by Laura Delow

12:02 PM, 11th December 2019, About 2 years ago

Even if it is a scam, I believe you do need to register with the ICO even if you do not process / hold the personal information as you are the Controller who determines the purposes for which the data is processed and/or the means of processing & you have appointed processors to process the personal data on our behalf.
Copy/paste the following address in to your browser for more detail:-

by Prakash Tanna

12:07 PM, 11th December 2019, About 2 years ago

The new GDPR which came into effect 25th May 2018, let's be honest was a cash cow for the government and hence the ICO is chasing Landlords to sign up. What exactly do you get for the fee you pay them apart from an electronically generated certificate which a 5yr old could of produced?

My understanding is if you hold any personal data on tenants (past, present or prospective future) you have to register with them. Further info. can be found at:
Hope you find that useful.

by Luke P

12:32 PM, 11th December 2019, About 2 years ago

Reply to the comment left by Prakash Tanna at 11/12/2019 - 12:07
They're starting to operate very much like TV Licensing in that they presume you should be registered and will hound anyone who isn't. I wish I'd never registered, because once you're head is up, they have your details to shoot you down. It's nothing more than a stealth tax.

by Prakash Tanna

12:41 PM, 11th December 2019, About 2 years ago

Reply to the comment left by Luke P at 11/12/2019 - 12:32
Agreed - that's exactly what it is!

Another one is a Waste Carrier's Licence which I also pay for and get nothing in return for! I'm not trying to promote paying the Government's fees, but anybody who carries waste, say a Landlord who goes to do a repair on a property and takes away the waste, technically needs one of these too! lol


by Beaver

12:48 PM, 11th December 2019, About 2 years ago

One of the reasons this is happening is because of the behaviour of estate agents.

A few years ago I had to rent a house for a relative which was rented out through an estate agent. The estate agent took my personal details including my email address and although I had not given permission for this to happen immediately started sending me mail shots and emails. This was illegal. And it's no bad thing that the ICO is tightening up on it.

So without knowing more about your limited company it's not possible for anyone to say whether you are obliged to register with the ICO or not. If your company is only keeping the minimum details for accounting purposes it may not need to be. If on the other hand your company is behaving like an estate agent then you will need to be.

by Luke P

12:57 PM, 11th December 2019, About 2 years ago

Reply to the comment left by Prakash Tanna at 11/12/2019 - 12:41You technically need one for taking home the contents of your desk bin from your place of work, even if it does only contain your sandwich packaging.

by Luke P

13:04 PM, 11th December 2019, About 2 years ago

Reply to the comment left by JJ at 11/12/2019 - 12:48
Any ‘processing’ of data (obtaining, recording, storing, updating or sharing) using a computer of system that can process the information automatically (including the use of CCTV for the purpose of crime prevention) by ANY business (all Limited Companies being such) are required to have a licence, which may include you JJ.

Data Protection and GDPR are already legislation so how does registering and paying an annual fee to the ICO change anything?

1 2 3 4 5 6 7 8 9

Leave Comments

Please Log-In OR Become a member to reply to comments or subscribe to new comment notifications.

Forgotten your password?


Landlord Tax Planning Book Now