Most of HMRC’s information powers are about a named taxpayer. Schedule 23 is not. It lets HMRC require whole categories of business to hand over bulk datasets, without suspecting anyone of anything, and it is a large part of the reason enquiries now arrive with the answer already indicated.
On this page
Three Different Powers, Constantly Confused
HMRC has several ways of obtaining information, and the rules, safeguards and appeal rights differ sharply between them. The first question on receiving any notice is which power is being used.
| Power | About whom | Purpose | Appeal rights |
|---|---|---|---|
| Schedule 36 FA 2008 taxpayer notice | An identified taxpayer | Checking that taxpayer’s position | Appealable, subject to exceptions |
| Schedule 36 third party notice | An identified taxpayer, served on someone else | Checking that taxpayer’s position | Limited; usually needs taxpayer consent or tribunal approval |
| Financial institution notice | An identified taxpayer, served on a bank | Checking that taxpayer’s position | No appeal against the notice |
| Schedule 23 FA 2011 data-holder notice | Nobody in particular (bulk data | Building HMRC’s data holdings | Narrow) principally that compliance is unduly onerous |
Who Is a Data-Holder
Schedule 23 applies to prescribed categories of “relevant data-holder”. The categories are broad and cover a large proportion of ordinary businesses, including:
- Employers, and persons paying or receiving payments in respect of employment;
- Businesses making payments for services, including for construction and other contracted work;
- Merchant acquirers and payment processors, who hold card transaction data for retailers;
- Licence and approval authorities, including local authorities issuing trade licences;
- Investment plan managers, insurers and persons involved in settlements and trusts;
- Charities and persons involved in gift aid;
- Electronic payment providers and digital intermediaries.
The practical point for advisers is that many clients are data-holders without realising it. An ordinary trading company that engages subcontractors, or a business that takes card payments, sits within the regime.
The Notice, Approval and Appeal
- The notice. HMRC issues a data-holder notice requiring the specified data to be provided in a specified form and period.
- Tribunal approval. HMRC may seek the approval of the tribunal for a notice. Where approval has been given, the recipient’s ability to challenge is materially reduced.
- Appeal. The appeal rights are deliberately narrow. The principal ground is that compliance with the notice, or with a requirement in it, would be unduly onerous. There is no general right to argue that the data is not relevant or that HMRC should not have it.
- Penalties. Failure to comply attracts an initial penalty, followed by daily penalties for continued failure, with further penalties for providing inaccurate data.
The Wider Data-Gathering Picture
Schedule 23 is one component of a much larger data-gathering apparatus, and understanding the whole explains why HMRC so often opens an enquiry already knowing the answer.
- Connect. HMRC’s analytical system cross-references data from a very large number of sources (Land Registry, bank interest reports, card processors, letting and sales platforms, DVLA, Companies House, social media and more), and flags inconsistencies against returns. See our resource on the Connect system.
- Digital platform reporting. The United Kingdom adopted the OECD model rules for reporting by digital platforms, requiring platforms to collect and report information about the income of sellers using them. Reports flow to HMRC and, where the seller is resident elsewhere, to that jurisdiction’s authority. This is why online marketplace and short-let income is now routinely visible.
- The Common Reporting Standard. Automatic exchange of financial account information between participating jurisdictions. See our resource on how HMRC gets your offshore data.
- The Cryptoasset Reporting Framework. The OECD framework extending automatic exchange to cryptoasset service providers, with first exchanges following implementation.
- Real time information. PAYE data submitted on or before each payment gives HMRC a near-live view of employment income.
What This Means If You Are the Taxpayer
Most people encounter Schedule 23 indirectly: not because they receive a notice, but because a notice served on somebody else produced the data that led to their nudge letter or enquiry.
- Assume HMRC already has the data. By the time a nudge letter or enquiry arrives, HMRC has usually seen the underlying information. A response that contradicts data HMRC holds is far worse than a candid one.
- Ask what prompted the enquiry. HMRC will not always say, but it is worth asking, and a subject access request under the UK GDPR can reveal what is held about the taxpayer, subject to the exemptions. See our resource on making a DSAR to HMRC.
- Understand the difference between data and evidence. Bulk data indicates a mismatch; it does not establish a liability. Card acquirer totals include refunds and non-taxable receipts; platform data may include gross sums before costs; Land Registry data says nothing about beneficial ownership. Reconciling the data to the true position is often the entire answer.
- Consider disclosure before contact. Where there is an actual problem, an unprompted disclosure attracts materially better penalty terms than a prompted one, and the window closes the moment HMRC makes contact.
What To Do If You Receive a Data-Holder Notice
- Identify the power. Confirm it is a Schedule 23 data-holder notice and not a Schedule 36 third party notice, because the rules and appeal rights differ entirely.
- Check you are a relevant data-holder within the prescribed categories, and that the data sought falls within what may be required of that category.
- Diarise the deadline and the appeal window.
- Scope the work before responding. Establish what data exists, in what systems, in what format, and what extraction would involve. This is the evidence for any “unduly onerous” argument and the basis for negotiation.
- Negotiate first. HMRC will frequently agree a narrower scope, a different format or a longer period. That is a better outcome than an appeal on the only available ground.
- Consider data protection obligations. Complying with a lawful notice is a legal obligation and provides a basis for disclosure, but the data-holder should record its analysis and consider whether it needs to inform data subjects.
- Check accuracy carefully. Penalties apply for providing inaccurate data as well as for failure to provide it.
- Take advice before ignoring it. Daily penalties accrue, and non-compliance is a poor position from which to argue about anything else.
Frequently Asked Questions
What is a Schedule 23 data-holder notice?
A notice under Schedule 23 to the Finance Act 2011 requiring a prescribed category of business or body to provide bulk data to HMRC. Unlike a Schedule 36 notice, it is not about any identified taxpayer. HMRC does not need to be checking anyone’s tax position and does not have to suspect anything. It is collecting datasets to feed its analytical systems.
Can I appeal a data-holder notice?
Only on narrow grounds, principally that compliance would be unduly onerous. There is no general right to argue that the data is irrelevant or that HMRC should not have it, and where the tribunal has approved the notice the ability to challenge is further reduced. In practice, negotiating the scope, format and timescale with HMRC is usually more productive than appealing.
How do I show that compliance is 'unduly onerous'?
With evidence about what compliance would actually involve: which systems hold the data, whether they hold it in the form requested, the volume of manual extraction required, the cost, and the diversion of staff. It is a burden argument, not a merits argument. A general complaint about inconvenience will not succeed.
Am I a data-holder without knowing it?
Quite possibly. The prescribed categories cover employers, businesses making payments for services including construction, merchant acquirers and payment processors, licence and approval authorities, investment plan managers and insurers, charities, and electronic payment providers and digital intermediaries. An ordinary trading company that engages subcontractors or takes card payments sits within the regime.
HMRC seems to already know about my income. Where did it get that?
Most likely from bulk data. Schedule 23 notices, digital platform reporting, the Common Reporting Standard, real time PAYE information, bank interest reports and Land Registry data all feed HMRC’s Connect system, which flags mismatches against returns. That is why nudge letters and enquiries frequently arrive with the answer already indicated, and why a response inconsistent with data HMRC holds is worse than a candid one.