Data protection guidance for Electoral Registration Officers and Returning Officers

Registering as a data controller

You have a statutory duty to process certain personal data to maintain the electoral register and/or for the purpose of administering an election. As such, in line with current data protection legislation, you are acting as a data controller.

Data controllers are required to register with the Information Commissioner’s Office (ICO).1

Advice from the ICO is that all data controllers will need to ensure that they are registered. This means that you must be registered separately to your council in your capacity as ERO and/or RO. 

The ICO have advised that if you are both an RO and an ERO one registration can cover both roles, and that where you have an additional role as a Regional RO, Police Area RO, Combined Authority RO etc, one registration can be used for all titles but this needs to be included in the name of the organisation when registering. 

In Scotland, where the ERO and the Assessor are the same person, the ICO have advised that one registration can also cover both roles, but both titles need to be included in the name of the organisation when registering.

Registration fee

The ICO have provided further guidance relating to the fee to register as a data controller on their website, including examples of how the fee should be calculated. 

When calculating the number of staff you employ, this should be determined pro rata, i.e. evened out throughout the year. For example, if you are an RO and you only employ staff in April and May to administer an election, the total staff employed in April and May would need to be apportioned throughout the year to determine the number of staff you employ.

As such, it is likely that the fee would always fall into the lower category. If you are using a joint registration as ERO and RO, you will need to be careful when calculating the number of staff since you will need to consider the total staff across both functions.

You should direct any questions in relation to registering as a data controller towards the ICO.

Last updated: 22 February 2023