ICO: Chatbot
A chatbot that's hosted on the ICO website to support organisations who have enquiries relating to Data Protection Fees.
1. Summary
1 - Name
ICO Chatbot
2 - Description
The chatbot is hosted on the ICO website under the Data Protection Fees section. It is used by organisations visiting the site to answer questions about whether they need to register with the ICO and at what tier level.
3 - Website URL
https://ico.org.uk/for-organisations/data-protection-fee/#
4 - Contact email
Tier 2 - Owner and Responsibility
1.1 - Organisation or department
Information Commissioner’s Office
1.2 - Team
Digital, Data and Technology (DDaT)
1.3 - Senior responsible owner
Director of Digital and IT
1.4 - Third party involvement
Yes
1.4.1 - Third party
ICS.AI
1.4.2 - Companies House Number
11346801
1.4.3 - Third party role
ICS.AI built the chatbot for us and currently license and support the chatbot
1.4.4 - Procurement procedure type
Framework agreement
1.4.5 - Third party data access terms
No direct access to ICO data
Tier 2 - Description and Rationale
2.1 - Detailed description
The ICO send letters to organisations every year. To help them manage the influx of user queries as a result, ICS.AI developed a web-based AI assistant to guide individuals through the process of paying personal identification information fees, checking the requirement to register, and completing the registration where applicable. This tool is available on the ICO’s website and allows users to search for information, save their progress, go back to previous answers, and receive guidance to pay the correct fee.
2.2 - Benefits
This solution has processed over 360,000 queries so far, and has significantly reduced the workload for ICO staff, who previously had to manually respond to each query. In addition, the AI assistant has improved user experience by allowing individuals to self-serve their queries and avoid the need to contact the ICO directly. The AI assistant has a >85% first time response accuracy.
2.3 - Previous process
Reliant on navigating the website and reviewing different guidance documents.
2.4 - Alternatives considered
N/A
Tier 2 - Deployment Context
3.1 - Integration into broader operational process
The tool sits on our website and depending on the results on fee assessments for example, will then navigate users to complete their registration online if they are required to register. The tool does not directly make any decisions, more a series of pre populated “storycards” dependent on the nature of the query.
3.2 - Human review
No human review as no decision making capability
3.3 - Frequency and scale of usage
The tool has processed over 360,000 to date. The monthly volume can vary depending on our level of contacts with unregistered organisations.
3.4 - Required training
None
3.5 - Appeals and review
If further assistance outside of the chatbot is required, it will prompt the user to contact the ICO using the details on the ‘Contact Us’ page.
Tier 2 - Tool Specification
4.1.1 - System architecture
Web based that sits within the Data Protection Fees element of our website. Maintained by our partner ICS.AI. Further information is provided at the following link - https://www.ics.ai/ico-case-study
4.1.2 - System-level input
The ICO Digital Assistant chatbot starts up by offering the user three possible journeys, by displaying cards containing questions and information on the following topics: • Do I need to pay? • How much do I need to pay? • Do I need to register a DPO? It’s also equipped to answer 27 of the ICO’s most frequently asked questions about the data protection fee.
4.1.3 - System-level output
All the user needs to do is type their question into the box, hit send, and the chatbot’s AI will determine the correct response. Whilst these are questions we cover on our website now, the chatbot makes it much easier for customers to find the answer. If the chatbot is unable to find a pre-loaded answer, it will search the ICO website and return relevant results to the user. If further assistance outside of the chatbot is required, it will prompt the user to contact the ICO using the details on the ‘Contact Us’ page.
4.1.4 - Maintenance
Managed by our partner ICS.AI.
4.1.5 - Models
The ICO Digital Assistant chatbot uses ICS.AI’s proprietary SMART:CHAT software. More information is available on their website - https://www.ics.ai/smart-channels/smart-chat
Tier 2 - Operational Data Specification
4.4.1 - Data sources
User inputs
4.4.2 - Sensitive attributes
No
4.4.3 - Data processing methods
N/A
4.4.4 - Data access and storage
No data is stored on the enquiries unless the user proceedes to registration.
4.4.5 - Data sharing agreements
N/A
Tier 2 - Risks, Mitigations and Impact Assessments
5.1 - Impact assessments
A full DPIA was not required as our screening assessment indicated that this tool was unlikely to result in high risks to individuals. A Data Protection Compliance Checklist for low risk processing was completed in February 2021 and updated in September 2025.
5.2 - Risks and mitigations
We identified a Privacy risk as users may intentionally or inadvertantly enter personal data into the tool. To mitigate this, when a user opens the tool they see a clear instruction that they do not need to share personal data in order to use the chatbot service. This message also identifies the third parties that information entered into the tool will be shared with and includes a link to the full ICO Privacy Policy. Additionally on a quarterly basis we conduct a high level review of content to ensure accurancy as well as evaluating the metrics provided by our partner of succesful resolution of queries.