"If your organisation has not yet achieved compliance, please provide an explanation about why it has not been possible to comply within time, a clear timescale for when compliance will be achieved, and details of specifically what work is being done to make that happen."

The companies have been given 28 days to provide this information to the Information Commissioner.

It is also highlighted in the letter that the ICO has a "range of options available" to it to take formal action where companies cannot prove that they are working towards compliance within reasonable timeframes. These options include undertakings, committing organisations to a particular course of action to enforcement notices and possible fines of up to £500,000.

However, in a briefing last week the ICO told journalists that it was out penalties, as it would have to prove that a breach had caused "substantial distress" to users. It was also revealed that the to comply as long as they can prove that they are working within a 'reasonable timeframe'.