The ICO data protection fee is easy to overlook when setting up a UK business. You register a company, build a website, start collecting customer enquiries and then receive a letter about paying the Information Commissioner’s Office (ICO). Is the letter genuine? Do you need to pay if you are a sole trader? And does payment mean your business is compliant with the UK GDPR?
The answer depends less on your business label than on what you actually do with people’s information. Here is how to assess the ICO fee UK requirements without costly mistakes.
Who needs to pay the ICO data protection fee?
Most organisations that process personal data as a controller must pay an annual data protection fee unless an exemption applies. A controller decides why and how personal information is used. That can include a limited company, sole trader, charity or other organisation.
Personal data is broader than a customer database. Names attached to email addresses, staff records, appointment details and CCTV footage can all identify people. Yet simply holding personal data does not automatically mean a fee is payable: the purpose of processing matters.
For example, a consultancy that manages client case files or a shop using CCTV to prevent crime is likely to need ICO registration and payment. A business using personal information solely for certain exempt activities may not. The ICO’s official registration self-assessment is the best starting point when your position is unclear.
When can a UK business claim a fee exemption?
The ICO lists exemptions where personal data is processed only for specified purposes, including staff administration, accounts and records, and advertising, marketing or public relations for your own business. Certain not-for-profit activities, personal household activities and other defined circumstances may also qualify.
The word “only” is crucial. An exemption may stop applying if you also process information for a non-exempt purpose. Do not assume that a business is exempt because it is small, works from home or has just one customer.
Consider a freelance designer who holds contact details solely to invoice clients and promote their own services. Those activities may fall within the fee exemption. If the designer begins operating crime-prevention CCTV at a studio, the assessment changes: the ICO says organisations using CCTV for that purpose must pay.
Exemption from the fee is not exemption from data protection law. Keep a record of the reasoning behind your decision and revisit it when your services or systems change.
How much is the ICO data protection fee in 2026?
The annual rates introduced in February 2025 remain listed in current ICO guidance. There are three main tiers:
Tier 1: £52 per year
Typically applies when an organisation has no more than 10 staff members or annual turnover of no more than £632,000. The ICO uses specific rules to count staff, including part-time workers.
Tier 2: £78 per year
Applies where tier 1 does not and the organisation has no more than 250 staff members or annual turnover of no more than £36 million.
Tier 3: £3,763 per year
Generally applies when neither lower tier fits. There are special provisions: qualifying charities and small occupational pension schemes pay the tier 1 amount, while public authorities are assessed using staff numbers rather than turnover.
Paying by Direct Debit reduces the annual fee by £5. The statutory charge is outside the scope of VAT. Use the ICO’s fee self-assessment rather than guessing your tier from revenue alone.
How to register and pay safely
First, complete the assessment on the official ICO website. If you need to pay, use its first-time registration service and provide your organisation’s details, turnover and staff information. The service also asks for contact details and payment information.
Payment can be made through the ICO’s accepted methods, including Direct Debit or card. After payment is processed, your organisation is normally added to the public register of fee payers. Some registration details, such as the organisation’s address, are published, so sole traders should consider which valid business contact address they provide.
Be cautious about letters and websites requesting an unusually high “registration” charge. Unofficial intermediaries may charge extra for something you can do directly. Navigate to ico.org.uk yourself rather than relying on an unexpected payment link.
What ICO registration does not cover
Paying the fee is an administrative obligation, not a licence to collect any information you like. It does not certify that your privacy notice, marketing emails, cookies or security practices comply with the law.
A business still needs a lawful basis for processing, clear information for individuals, appropriate security and procedures for handling people’s rights. The practical next step after fee registration is a UK GDPR compliance checklist covering the data you collect and why.
For websites, privacy notice requirements for UK businesses also deserve a separate review. A registration number on the footer cannot replace a meaningful explanation of how visitors’ information is handled.
What to check at renewal time
The fee is normally payable every 12 months. The ICO sends renewal reminders, but responsibility remains with the organisation. Its guidance says the annual period runs from the renewal date, not simply the day payment is made.
Before renewing, check whether your staff numbers, turnover, business address and nominated contact have changed. Reassess whether you still process personal data for purposes requiring payment. If your business has closed or genuinely become exempt, use the ICO’s process for notifying it where appropriate rather than ignoring correspondence.
A small annual review can prevent two opposite errors: continuing to pay after qualifying for an exemption, or relying on an old exemption after introducing new services. If you have installed security cameras, review CCTV and data protection rules before assuming the previous fee decision still applies.
Frequently asked questions
Do sole traders have to pay the ICO fee?
Sometimes. Being self-employed does not create an automatic exemption. A sole trader who determines how personal data is used for non-exempt purposes may need to register and pay. Check the actual processing activities, not the business structure.
Do I need ICO registration if I only keep employee and invoice records?
Processing personal information solely for staff administration and accounts and records may qualify for an exemption. If you also use information for other purposes, reassess your position using the ICO’s official tool.
What happens if a business should pay but does not?
The ICO can pursue unpaid fees and issue monetary penalties after the relevant notice process. Its current guidance refers to a maximum penalty of £4,350 for non-payment. Respond promptly to a genuine ICO notice rather than assuming it is optional.
Does paying the fee prove UK GDPR compliance?
No. ICO registration shows that an applicable fee has been paid. It is not an audit, certification or general approval of how the business uses personal information.
A practical way to stay compliant
Start by listing the personal data your business handles and the purpose of each activity. Check those purposes against the ICO’s exemptions, confirm your fee tier if payment is required, and record the renewal date. Revisit that assessment whenever the business changes. A few minutes spent checking the facts can save both an unnecessary payment and a costly compliance oversight.