Types of ICO notice 

The most common action the ICO can take is to issue a notice to a data controller or data processor. Under Part 6 of the Act, the ICO can issue an: (1) Information Notice, (2) Assessment Notice, (3) Enforcement Notice, and (4) Penalty Notice, each of which is taken in turn below. 

In March 2022, the ICO closed its consultation on regulatory action, which included a statutory guidance document titled 'Statutory Guidance on our Regulatory Action.' Whilst still only in draft form, this guidance provides insight into the ways in which the ICO aims to carry out its role of ensuring compliance with data protection laws and upholding information rights in the public interest.  

Information Notice (Section 142 of the Act) 

Assessment Notice (Section 146 of the Act) 

Enforcement Notice (Section 149 of the Act) 

Penalty Notice (Section 155 of the Act) 

Managing ICO notices 

If you receive a notice from the ICO, what should you do? The notice should be passed to the relevant individual/s within your organization responsible for data protection and/or ensuring that external legal counsel is engaged as needed to assist with responding. It may be helpful to set reminders for the deadline to respond and at this stage, ask for an extension of time if you believe this is needed. 

You should also review the ICO notice and consider whether to provide comments to the ICO before responding in full. For example, you may wish to highlight where you may not be able to provide certain information and/or clarify certain points that the ICO has raised. This may assist in ensuring that when you respond, you provide the most helpful response to the ICO and demonstrate that you have assisted the ICO to the greatest degree possible.  

Regarding Assessment Notices and the ICO requesting access to premises, please see our guidance below in relation to dawn raids and the ICO's powers of entry and inspection.   

Dawn raids - the ICO's powers of entry and inspection 

Pursuant to Schedule 15 of the Act, the ICO may obtain a warrant from the court to exercise the power of forcible entry, search, inspection, and seizure, if the ICO has reasonable grounds for suspecting that a crime has been committed under the Act or a data controller or data processor is failing to comply with the data protection legislation. The ICO does not publish a list of dawn raids it has carried out, however the ICO has been known on occasion to use these powers, most notably in relation to Cambridge Analytica in 2018.  

A court will only issue a search warrant if:  

• one of the following conditions apply: 
  • at least seven days have elapsed since the ICO gave notice in writing demanding access to the premises;  
  • either the ICO demanded access at a reasonable hour, but that access was refused, or access was granted but the occupier unreasonably refused to comply with the request;  
  • the occupier of the premises was notified by the ICO that an application for warrant had been made and the occupier had the opportunity to be heard by a judge on the issues; and  
  • if personal data involved involves special purposes, a determination under Section 174 of the Act must have taken effect; 
• compliance with those conditions would defeat the object of entry to the premises; or  
• the ICO requires access to the premises urgently. Upon issuing a warrant, the judge must be satisfied that there are reasonable grounds to suspect that evidence of the offense or failure to comply could be found on the premises.  

If a search warrant is issued, the ICO may have the authority to:  

• enter premises to view certain documents or observe the processing which takes place on the premises;  
• inspect personal data where international obligations make inspection necessary; 
• ensure controllers are processing personal data in accordance with the data protection framework;  
• inspect, examine, operate, and test any equipment found on the premises that is used for or intended to be used for the processing of personal data;  
• inspect and seize any documents or other material found on the premises that may enable the ICO to determine whether a controller or processor is complying with data protection legislation;  
• require any person on the premises to provide an explanation of any document or other material, including any information as may reasonably be required for the investigation; and/or  
• in executing the warrant, use such reasonable force as may be necessary.  

There is a statutory presumption that the powers of entry granted to the ICO under a warrant must be exercised at a 'reasonable hour' within seven days of the warrant being issued, unless the ICO has reasonable grounds to believe that undertaking an inspection at such reasonable hour would defeat the object of the inspection.  

During the inspection of documents and materials on the premises, investigators cannot require the production of legally privileged material. This includes all confidential communications between lawyer and client made for the purposes of giving legal advice with respect to data protection legislation, or for the dominant purpose of proceedings under or arising out of data protection legislation (litigation privilege). It is important to note that the legally privileged exemption does not cover all material that would ordinarily be protected by legal professional privilege - the exemption only covers documentation relating to advice given or proceedings under or arising from data protection legislation. 

Managing dawn raids  

Considering that criminal liability attaches to failures to cooperate with ICO investigations, it is essential to have a procedure in place in order to deal with a dawn raid in a measured and sensible way. By way of preparation, an organization should have a written plan to deal with dawn raids and identify a dawn raid response team. This team should comprise of a leader who is either the data protection officer or a member of senior management. All key employees should have received appropriate data protection training, including what they need to do in the event of a dawn raid. The details of the response team, including telephone numbers and emails, should be readily available, particularly to reception or other front of house staff, as these individuals will need to be contacted immediately in case of an investigation.  

In addition, the following practical steps should be taken during the raid:  

1. Shadowing. The investigators will have the power to search and inspect all materials and property within the premises. A person familiar with the dawn raid procedure and the mandate of the investigation, preferably a member of the external or internal legal team, should shadow the investigators. Given that investigating teams can be large in number, it is important to ensure there are sufficient resources to shadow the investigators adequately. These resources should also conduct an immediate debrief with both internal and external legal counsel after the raid to understand which materials or property were requested, reviewed, copied, or seized and whether any disputes arose about materials or property (for example regarding privileged materials).  
2. IT support. During the investigation, the investigators will expect certain persons to be available to explain the organizational structure of the company and any IT systems that are used. The investigators will rely heavily on searches of emails and other electronic documents and therefore may require access to and support from an IT member to assist with specific IT tasks and for the provision of administrator access rights.  
3. Record. It is important to keep note of any records (both electronic and hard copies) which have been taken by the investigators. Within this, it is important to ensure that an additional copy has been made for the company's own records. 
4. Employee interviews. The investigators will want to ask employees questions, which may include oral explanations relating to documents. It is common for external or in-house counsel to be present during the questioning, or for an arrangement to be in place for independent representation in the event of a conflict of interest. It is important that any records detailing the discussions are kept, including the questions asked and responses given. The questions and responses should also feed into the debrief that takes place after the raid.  
5. Privilege. Any materials accessed or seized by the ICO that are or may be privileged should be logged and objections raised with the ICO investigators at the time.  

Kelly Hagedorn Partner 
[email protected]  
Hanna Hewitt Associate 
[email protected]  
Lucy Mann Trainee Solicitor 
[email protected]  
Orrick, Herrington & Sutcliffe LLP, London