Thousands of UK firms have recently been duped into paying fake data protection agencies for registration under the Data Protection Act. Companies are advised that if registration is necessary this can be done directly through the Information Commission by filling in a downloadable form from its site and forwarding it with a £35 fee.

Last week the Office of Fair Trading said about 4,000 UK firms had been fooled into paying money to companies for registration. They had responded to letters telling them that as information processors they would have to pay a £95 fee or face a £5,000 fine.

Under the UK's Data Protection Act, firms that process or handle personal data have to register with the Information Commission as data handlers.

Failure to do so is punishable. However, companies should not be misled into believing that the Information Commission is using external agencies to approach and register firms.

The Information Commission includes on its Web site a list of companies that might offer registration services. It said these approaches should be ignored. A notice on the site explains: "Data controllers should ignore any approach made by [certain] businesses, who appear to be charging up to £95 + VAT for notification. Other than paying the annual statutory notification fee of £35, on which no VAT is payable, there is no charge made by this office."

Organisations wishing to make a complaint should contact their local Trading Standards Office.

Information about compliance is available from the Information Commission or by calling 01625 545740.

Have your say: reply to IT Week