ICO Data Protection Fee Register Maximisation Delivery Partner

Descriptions

ICO Data Protection Fee Payers Register - Market Shaping Opportunity

Our goal is to secure a delivery partner who can help us bring in-scope organisations into compliance through registration on the Data Protection Register and maximise the fees we receive. Join our supplier engagement session on Thursday 24 July 2025 at 2pm to help shape our approach - and potentially play a central role in future delivery. To express your interest and receive an invitation to the engagement session, please submit your contact details via https://www.delta-esourcing.com/respond/2YBJ6D7SQ4

Introduction

The Information Commissioner's Office (ICO) is the UK's independent regulator for information rights. We oversee and enforce a range of legislation, including the Data Protection Act 2018, UK GDPR, and the Freedom of Information Act 2000. Our role is to safeguard personal data, promote openness and accountability, and maintain public trust in how information is handled.

A substantial part of our funding comes from the statutory Data Protection Fee, which organisations must pay if they process personal data and meet the relevant criteria. The fee supports our core regulatory functions; from offering advice and guidance, to carrying out investigations, and taking enforcement action where necessary. It also enables us to deliver services that help reduce the cost of compliance for organisations across the UK.

Improving registration compliance is about more than recovering unpaid fees. A more complete and accurate register strengthens our ability to regulate effectively, supports fair treatment across sectors, and helps ensure that the data protection framework works as intended. It enables better planning, more targeted engagement, and ultimately, stronger outcomes for both organisations and the public. You can find more about our work at ico.org.uk.

What We Know So Far.

Our public register currently includes just over 1.2 million organisations. However, we estimate there could be up to 2 million more that fall within scope but have not registered. That gap represents a significant compliance risk and an estimated £75 million in unclaimed fees.

Since the introduction of the GDPR in 2018, we've more than doubled the size of the register - largely through outbound campaigns based on data from Companies House and similar sources. Most recently, we've used postal campaigns to contact potential registrants. While these letters have had some success, engagement remains low - particularly among small and micro businesses.

In October 2024, we issued a Prior Information Notice (PIN) to signal our intent to explore alternative approaches to increasing registration compliance. Since then, we've run a series of small-scale pilots to test different methods of identifying and engaging unregistered organisations. The results have been mixed - informative, but not conclusive enough to proceed directly to procurement. We're now seeking broader market input to help shape a more complete and effective solution. You can find the original under:

Notice identifier: 2024/S 000-031719

Procurement identifier (OCID): ocds-h6vhtk-04a575

Some exemptions to the fee apply, but our analysis suggests that a substantial proportion of the unregistered population may be liable and are simply not responding through the channels we've used so far.

What We're Looking For

This is an open invitation to help shape both how we solve the problem and how we appoint a delivery partner to turn insight into measurable registration outcomes - driving lasting improvements in compliance and fee recovery.

We want to hear from suppliers who can help us think differently about how to reach and engage organisations that haven't responded to traditional methods. This isn't just about communications - it could involve data identification, behavioural insight, prioritisation models, or something entirely new.

While email outreach may be part of the answer, we're looking for a complete view, from sourcing and validating data, to delivering messages and shaping content that drives action. We're also keen to understand what infrastructure, partnerships, or technologies already exist that could help scale or accelerate results.

Crucially, we want your advice on how to buy this well. We're aiming to build a compliant tender that reflects what the market can realistically deliver - and gives suppliers a fair opportunity to compete. We're particularly interested in your views on commercial models, evaluation criteria, and contract structures that support delivery, encourage innovation, and enable suppliers of all sizes to take part. We also welcome consortium bids and collaborative approaches that bring together complementary strengths.

We're seeking views from suppliers who can offer:

• Ways to identify and match unregistered organisations to reliable contact details, particularly email;

• Smart targeting methods (e.g. segmentation, scoring models, AI-led prioritisation);

• Effective outreach design and delivery - including message tone, timing, and content;

• Practical ways to define and measure success - especially conversion to registration and payment;

• Advice on how to structure the procurement to ensure fairness, flexibility, and delivery.

Whether you're a data provider, campaign specialist, tech platform, or something in between, we want to understand how you'd approach this challenge.

This is your chance to influence both the future tender and the strategy behind it - and play a central role in helping the ICO strengthen compliance and deliver better value to the public.

If you think you can help us connect the dots and offer a smarter, more effective way forward - whether through data, outreach, or something entirely different, we'd welcome your attendance at an engagement session on Thursday 24 July 2025 at 2pm

Colleagues from across the organisation will share an expanded overview of our current approach to registration and fee recovery, including further detail on known gaps and insights from recent pilot activity. After the session, we'll invite suppliers to submit a short-written response outlining early ideas on how you might support future delivery. These responses will help us shortlist suppliers for follow-up one-to-one conversations. We're happy to hold these discussions under an NDA, if required. This engagement will inform the design of a potential future procurement opportunity.

The engagement deadline has been extended to allow additional time for the receipt and review of Expressions of Interest and where appropriate, for the ICO to schedule follow-up discussions.

Suppliers are encouraged to express interest promptly to support timely engagement planning.