ICO Registration: The Unglamorous Thing Most Small Agencies Skip

If a business processes personal data commercially in the UK, it likely needs to register with the ICO. Most small agencies don't check.

Any UK business that processes personal data — client contact details, job applicants' CVs, end users of a product it builds — is very likely required to register as a data controller with the Information Commissioner's Office and pay the annual data protection fee, unless a specific exemption applies. It's not optional based on company size; it's based on what data you handle.

FourSix46 Global Ltd, trading as Stack46, is registered with the ICO (registration reference ZC052022). We're not pointing this out because it's impressive — registering isn't a badge of technical skill. We're pointing it out because it's the kind of basic legal compliance that's easy to skip when nobody's checking, and skipping it is exactly the kind of shortcut that tells you something about how a business treats obligations it thinks no one will notice.

Why this matters when you're choosing who builds your software

If an agency is going to touch your users' personal data — through a contact form, a signup flow, an admin panel with customer records — their own compliance posture becomes part of your risk, not just theirs. A vendor who hasn't registered as a data controller themselves is a weak signal for how carefully they'll handle data protection obligations inside your product.

The practical takeaway

It costs an agency very little to register. It costs a client a lot to discover, after the fact, that their vendor never did. It's a five-minute thing to check before you engage anyone to build software that will touch real people's data — ask for the registration reference, and check it against the ICO's public register.