You’ve started a business, become a landlord, or started a charity. As part of this you have taken responsibility for GDPR compliance or received a letter from the Information Commissioner’s Office asking you to pay a data protection fee.
But does every business need to register with the ICO? What if you’re a sole trader, a community group or a small organisation that only holds basic customer information?
The answer depends on how you use personal data, whether you’re acting as a data controller and whether an exemption applies.
This article will help you determine whether you need to pay, which fee tier applies and what happens if you do not pay.
What Is the ICO Data Protection Fee, and Why Must Organisations Pay It?
The requirement to pay the data protection fee comes from the Data Protection (Charges and Information) Regulations 2018, as amended, made under the Data Protection Act 2018.
There are four key things to remember
- The fee is a statutory obligation for controllers that are not exempt.
- The money helps fund the ICO’s data protection regulatory activities.
- Fee-paying controllers are given a registration number are included on the ICO’s public register. This can be a sign of trustworthiness for your organisation.
- There is no assessment or test of your GDPR compliance as part of paying the fee.
Even so, it is important to understand that the fee is not a payment for permission to process personal data. Also, registration does not demonstrate that an organisation complies with the UK GDPR. GDPR compliance work and accountability for compliance still remain. So, while registration shows you are taking your responsibilities seriously paying the ICO fee is one compliance obligation. Meeting the requirements of data protection law is another.
How Much Is the ICO Data Protection Fee?
The data protection fee is charged in three tiers, and the exact fee depends on the size of the organisation. This is a proxy for an organisation’s data processing activities and as noted above there is not assessment of GDPR compliance or the extent of an organisation’s data processing activities. A £5 annual discount applies when paying by Direct Debit. Special tier rules apply to public authorities, charities and small occupational pension schemes
ICO data protection fee tiers
Current published annual fees, October 2026
Tier 1: Micro £52
Turnover up to £632,000 OR no more than 10 staff
Tier 2: Small / medium £78
Turnover up to £36m OR no more than 250 staff, unless Tier 1 applies
Tier 3: Large, £3,763
Organisations not qualifying for Tier 1 or 2
Important points to note
- The turnover and staff thresholds are alternatives, not cumulative requirements.
- Public authorities calculate their tier by staff numbers rather than turnover.
- Charities and qualifying small occupational pension schemes pay Tier 1 if they are not otherwise exempt.
- Part-time staff count as individual staff members under the fee calculation rules.
- The fee is renewed every 12 months.
You can read the ICO’s official fee guidance here.
Who Is Exempt from Paying the ICO Data Protection Fee?
The ICO identifies several exempt purposes. Where an organisation processes personal data only for one or more of these purposes, an exemption may apply.
| Exempt processing purpose | Example |
| Staff administration | Maintaining employee payroll and personnel records |
| Advertising, marketing and public relations | Marketing the organisation’s own products or services |
| Accounts and records | Maintaining relevant business accounts and transaction records |
| Not-for-profit purposes | Certain processing undertaken for qualifying not-for-profit activities |
| Personal, family or household affairs | Managing personal contacts and household information |
| Maintaining a public register | Processing for the relevant register |
| Judicial functions | Certain processing connected with judicial functions |
| Non-automated processing | Processing personal information without an automated system, within the exemption’s scope |
It is important to bear in mind exemptions depend on what you do with the data
A business is not automatically exempt simply because it is small, has only a few customers or processes limited personal data.
Equally, a charity is not automatically exempt from the fee just because it operates on a not-for-profit basis.
If an organisation undertakes processing outside the exempt purposes, it may become liable for the fee even though its other activities are exempt.
For example: a company may process employee information for staff administration and customer information for accounts, but introducing CCTV for crime prevention can create a fee obligation. The ICO specifically identifies crime-prevention CCTV as processing requiring payment.
How Can You Check Whether You Need to Pay?
The ICO’s self-assessment tool is the best place to get a definitive answer, but in general terms:
Please use the ICO’s tool instead of relying on this illustration.
Practical Examples: Who Pays and Who Doesn’t?
To help explain the data protection fee and exemptions more practically let’s consider some illustrative examples:
| Organisation | Likely position |
| A sole trader processing personal data only for exempt accounts and their own marketing purposes | May be exempt |
| A small business operating CCTV on their premises for crime prevention | Generally must pay |
| Recruitment agencies processing candidate information to provide recruitment services | Generally must pay, and the business depends on processing personal data and especially if it does criminal record or right to work checks |
| A charity processing data solely for qualifying not-for-profit purposes | May be exempt |
| Private healthcare providers processing patient information | Generally must pay, due to the volume and sensitivity of the data it processes |
| An IT company acting solely as a processor for clients | Processor activities do not themselves trigger the fee; the IT company should assess any controller activities separately |
| A small consultancy maintaining client records | Depends on the actual purposes and nature of processing. For example, performing credit checks means you would have to pay the fee |
How Do You Register and Pay the ICO Fee?
If you need to pay the data protection fee simply visit the ICO’s site here are:
- Complete the ICO’s fee assessment.
- Identify the correct fee tier.
- Provide the organisation’s required registration details.
- Pay the fee through the relevant website.
- Keep registration information current and renew when required.
What Do You Do If You Think You’re Exempt?
If you believe you are exempt you should visit the ICO’s website and make contact with their team. Do not ignore any letter requesting payment as non payment can received a significant find (see below).
What Happens if You Don’t Pay?
Failing to pay when required can result in enforcement action and a monetary penalty, in addition to the unpaid fee.
The exact amount will depend on a range of factors, so rather than highlight a potential maximum fine that may not apply, we are linking to the ICO’s current fee enforcement information.
We also want to emphasise that the best response to a reminder is to establish whether the fee is payable and take the appropriate action promptly.
Does Paying the ICO Fee Mean You Are GDPR Compliant?
No. As noted above paying the fee does not demonstrate that you have:
- Selected appropriate lawful bases.
- Provided compliant privacy information.
- Implemented suitable security measures.
- Established appropriate retention periods.
- Put processes in place for handling individual rights.
- Assessed relevant data protection risks.
The fee is an administrative statutory obligation, not an ICO certification or approval of your organisation’s practices.
This creates a logical transition from the question “do we need to register?” to “are our wider GDPR arrangements appropriate?”
Frequently Asked Questions
Some of the most common questions people ask about paying the data protection fee include:
- Do sole traders need to register with the ICO? Sole traders must register with and pay a data protection fee to the ICO if they process personal data, unless they qualify for an exemption.
- Do charities have to pay the data protection fee? Generally yes. If a charity processes staff data for HR or payroll, or handles external donor, beneficiary, or marketing data, it usually must register and pay.
- Does a limited company with no employees need to pay? Having zero employees is not an exemption. If the company is acting as a data controller and using handle personal information such as customer or client names, email addresses, phone numbers, billing details, etc. the limited company would generally be required to pay.
- Do I need to pay the ICO if I only use customer data for invoicing? There is an exemption for accounts and records if you only use data for invoicing and statutory reporting for tax purposes. However, if you use customer data for anything else including tracking purchase history the exemption will not apply.
- Does CCTV mean I have to register with the ICO? Any organisations that ises CCTV for security, monitoring or crime prevention must register with the ICO and pay the data protection fee. This is true even if the organisation would be otherwise exempt.
- Can I cancel my ICO registration if I no longer need to pay? Yes. You can cancel by visiting to ICO website.
Conclusion
Many organisations that process personal data must pay an annual fee to the ICO, but exemptions exist for particular types of processing.
Whether a fee is payable depends primarily on the organisation’s role and how it uses personal information, rather than simply its size or legal structure.
Organisations should assess their position, pay the correct fee where required and review their obligations when their activities change.
ICO Registration Is Only One Part of GDPR Compliance
Paying the ICO data protection fee is an important legal obligation, but it does not mean your organisation’s wider data protection arrangements are compliant.
When did you last review your privacy notices, lawful bases, data protection policies, security measures and procedures for handling personal data?
At WuDo Solutions, we provide practical GDPR reviews and audits to help organisations understand their responsibilities, identify potential gaps and prioritise improvements.
Find Out More and Get in touch to discuss a GDPR compliance review for your organisation.