Recruitment agencies risk being targeted by a data protection scam that could leave them out of pocket.

A bogus organisation, which calls itself the Data Protection Enforcement Agency, targets young companies with a letter that says “you are not held on our records as having registered under the Data Protection Act”.

It also warns that failure to comply with the act could incur a large fine and urges companies to complete the enclosed form along with a fee of £135.

The Data Protection Enforcement Agency is one of around 30 bogus firms listed on the Information Commissioner’s website.

The website states that letters from the Information Commissioner always bear the Wycliffe House, Water Lane, Wilmslow address.

Many recruitment firms were slow to embrace the Data Protection guidelines controlling how an organisation gathers, stores and shares personal information when they first came into effect. One of the initial steps is to register with the Information Commissioner.

But only 72% of firms surveyed by the recruitment management consultancy Zebra claimed they followed the Employment Practices Data Protection Code – the government’s recommendations to ensure compliance.