Register of Data Controllers

It is a fundamental concept of data protection that the public should be able to find out who is processing their personal data and for what purposes. The Supervisor is required by the Data Protection Act 2002 to keep a register of data controllers.

Search the Register of Data Controllers

A regularly updated extract from the Register is available in a searchable PDF document. This list contains the names of those entities who have notified under the Data Protection Act 2002 and who process personal data outside the three core business purposes. It does NOT, however, contain any trading names but you may contact the Office if you wish to make such an enquiry.

If you require a copy of an entry, please email the office, stating the data controllers name and the notification number. We will supply a copy of a register entry free of charge, however, if you require a certified copy of a register entry a nominal fee of £2 will be charged.

Purpose of the Register of Data Controllers

The register serves three purposes:

• It enables individuals to discover, in general terms, who is processing their Personal Data, what the data may consist of and to whom it may be disclosed
• It provides Data Controllers with a mechanism to publicise details of their processing
• It helps the Supervisor to assess whether the data controller is processing personal data in compliance with the Data Protection Principles and the other provisions of the Act.

The register of data controllers is available for public inspection in the Office, between the hours of 09:00 and 13:00 and 14:00 and 17:00 Monday to Friday (excluding public holidays).

List of Data Controllers who have claimed an exemption from notification

There is no requirement for data controllers who are not required to have a register entry to advise the Supervisor of that fact, nor for the Supervisor to maintain such a list.

However, a list of data controllers who have claimed an exemption from notification is maintained and is available below. This list primarily assists third parties undertaking due diligence enquiries when seeking to engage in a business relationship giving an outward indication of whether that company r organisation has considered compliance with the Data Protection Act.

These data controllers, whilst exempt from notifying, are still obliged to comply with the Act and its remaining provisions.

They may claim this exemption from notification because they only process personal data for the three core business purposes, namely staff administration, accounts and records and advertising and marketing on behalf of the organisation. They may also be registered charities or non-profit making organisations who only process personal data for the three core business purposes and the other purposes specific to those types of organisation.