Take our website user survey

We're making improvements to our website and we'd love to hear your thoughts.

Please take five minutes to complete this survey to give your feedback.

Yes I'll take the survey

The ICO exists to empower you through information.

Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.

Which legal framework will my organisation be processing under?

Start again

1. Which legal framework will my organisation be processing under?

Not sure

Change this answer

2. Are you a competent authority, as defined under the Data Protection Act?

Section 30 of the DPA defines what a ‘competent authority’ is for the purposes of the Act. Schedule 7 of the Data Protection Act 2018 contains a list of competent authorities.

If you are not listed in Schedule 7, you may still be a competent authority if you have a legal power to process personal data for criminal law enforcement purposes. For example, local authorities who prosecute trading standards offences or the Environment Agency when prosecuting environmental offences.