ICO Registration Fee: Who Pays the Data Protection Fee (UK)

If you run a UK business that handles customer or staff details, you have probably seen the phrase "ICO registration" and wondered whether you need to file something with the regulator. The short answer is that there is no registration of your processing activities, but there is an annual data protection fee, and many businesses that handle personal data have to pay it.

This guide explains who must pay, which organisations are exempt, what the fee costs, how to work out your tier, what happens if you miss a payment, and whether the regulator's recent change of structure affects any of it.

Is there such a thing as ICO registration?

Not in the way many founders expect. Under the old data protection regime, controllers had to notify the regulator of their processing, and the ICO kept a public register of controllers and the personal data they handled. That requirement was dropped when the UK GDPR arrived, as it was seen as disproportionate to the benefit it gave to the protection of personal data.

What replaced it is the accountability principle. You do not file details of your processing with the regulator. You must be able to show that you comply with the data protection principles. The fee is a separate obligation and it still applies. When you pay, you give the regulator some basic details, such as your name and address, your staff and turnover bands and whether you are a public authority. The regulator also publishes the names of fee-paying organisations on a public register.

When people talk about ICO registration today, they usually mean paying this fee and providing those details.

Who has to pay the data protection fee?

You have to pay the fee if you are a controller of personal data and some of your processing is not exempt. A controller is the organisation that decides why and how personal data is used. In practice, that covers many businesses that hold customer, supplier or staff details.

A few points catch founders out:

A processor that only acts on another organisation's instructions does not pay simply for being a processor. It may still be a controller for its own processing, such as staff administration or business development.
Each separate legal entity assesses its own position. There is no group registration, so each company in a group that is itself a controller pays unless all of its own processing is exempt.
The fee is separate from your compliance duties. An exempt controller still has to comply with the UK GDPR and the Data Protection Act 2018.

The obligation does not depend on being a large company or on having a particular legal structure. A sole trader, a limited company and a charity can all be caught.

Which organisations are exempt?

The fee regulations set out what counts as exempt processing. The exemption is narrow, because all of your processing has to fall within one or more exempt categories. If any material activity is outside them, the fee is payable.

The main exempt purposes include processing solely for:

Staff administration, including appointments, pay, discipline, pensions and performance.
Accounts and records, including customer and supplier records needed for transactions, payments, deliveries and financial or management forecasting.
Advertising, marketing and public relations for your own business, goods or services.
Certain not-for-profit membership and supporter administration.
Personal, family or household affairs.
Maintaining a public register where legislation requires it.
Certain judicial functions.

There are important limits:

The accounts and records exemption does not cover personal data processed by, or obtained from, a credit reference agency.
The marketing exemption is about your own goods or services. Advertising for other businesses, selling customer lists or trading personal data generally falls outside it.
The not-for-profit exemption is not available just because an organisation does not make a profit. Its constitution, purposes, data subjects, data and activities all have to meet the criteria.
Using CCTV for crime prevention at business premises generally makes the fee payable, as crime prevention is not ordinarily an exempt core-business purpose. A work-related dashcam will generally have the same effect.
A dormant company that is not processing personal data electronically does not need to pay, but liability can continue if it keeps or uses records for non-exempt purposes.

Here is how that plays out for a consultancy. A consultancy that only handles payroll, its own accounts, basic transaction records for clients and marketing of its own services might be exempt. If it also provides advisory services that involve personal data about individual clients or third parties, it may fall outside the exemptions. The regulator's guidance indicates that consultancy services to individuals or partnerships are not generally an exempt purpose.

When the government reviewed the regime after a consultation in late 2018, it left the existing exemptions in place, citing the effect that removing them would have on micro organisations, the voluntary sector and small and medium sized businesses. It also added a new exemption for processing connected with standing for, or holding, elected office.

Do not assume you are exempt because you are small. List each of your processing activities and test them against the categories above. The regulator's online tool can help, and it is worth saving a record of the result.

How much is the data protection fee?

There are three tiers. The current fees took effect on 17 February 2025, when the government increased them. Paying by direct debit takes £5 off the fee in every tier.

Tier 1: £52 a year, or £47 by direct debit.
Tier 2: £78 a year, or £73 by direct debit.
Tier 3: £3,763 a year, or £3,758 by direct debit.

The fee is annual and has to be paid within the first 21 days of each 12-month charge period. For a new controller, the first period starts on the day you become a controller. After that, each period starts 12 months after the date your last payment was received, so your renewal date depends on when you paid, not on the calendar year.

How do you work out which tier you are in?

You self-assess. Nobody tells you your tier, so you compare your organisation with the criteria and pay the matching fee. The tests use "or", not "and", which works in your favour.

You are in Tier 1 if any one of these applies:

You have 10 or fewer members of staff.
Your annual turnover is £632,000 or less.
You are a charity.
You are a small occupational pension scheme, which broadly means fewer than 12 members, all of whom are trustees.

You are in Tier 2 if you are not in Tier 1 and you have no more than 250 members of staff or annual turnover of £36 million or less.

You are in Tier 3 if you do not qualify for Tier 1 or Tier 2. In practice, that means you have more than 250 members of staff and annual turnover above £36 million. You only reach the top tier when you fall outside both of the Tier 2 tests.

Two quick examples. A startup with six staff and £2 million of turnover is in Tier 1, as it meets the staff test even though its turnover is above the Tier 1 figure. A company with 40 staff and £5 million of turnover is in Tier 2.

A few details affect the count:

"Members of staff" is defined broadly. It includes employees, workers, office holders and partners, and it includes overseas personnel.
The figure is the monthly average over the relevant financial year, and each part-time person counts as one member of staff, not as a full-time equivalent.
The relevant financial year is generally the most recent one ending before the first day of your charge period. If you have existed for less than 12 months, it is the period you have existed.
Your position is fixed as at the first day of the charge period.
Public authorities assess their tier by staff numbers alone and ignore turnover.

Charities and small occupational pension schemes that have to pay sit in Tier 1. The regulator treats a controller as Tier 3 unless and until it has been given enough information to establish a lower tier, so make sure you supply your staff and turnover bands when you pay.

What happens if you do not pay?

The regulator can serve a monetary penalty notice on a controller that has failed to pay the fee. If you do not pay, or do not tell the regulator that you no longer need to, it can issue a notice of intent to impose a penalty 28 days after your payment period expires. You then have a further 28 days to pay or make representations. A penalty can then be imposed on top of the fee you still owe. If you do not renew on time, your entry can also expire and drop off the public register.

The law caps any penalty at 150% of the highest fee payable, ignoring any direct debit discount. With the top tier at £3,763, that puts the ceiling at about £5,645. For a Tier 1 business paying £52, that is many times the fee.

This is not a theoretical risk. In September 2018, shortly after the fee began, the regulator started formal enforcement action against 34 controllers for non-payment, issued its first fine and began action against care homes.

Tribunal decisions show how little room there is for excuses. In one early case, the tribunal dismissed an appeal against a £400 penalty where a direct debit had been cancelled by mistake. In another, it dismissed an appeal against a £4,000 penalty where a reminder arrived while the person responsible was on holiday and was not recognised internally as important. In both, the tribunal held that an innocent mistake was not a reasonable excuse. Not receiving a reminder does not remove the obligation either.

The lesson for a growing business is to treat the fee as a diarised compliance task. Make sure the renewal reminder reaches more than one person, check that any direct debit is still live, and record who owns the task.

Did the move to the Information Commission change anything?

Not the fee and not the requirement to pay it. On 30 September 2026, the Information Commissioner's Office became the Information Commission, a statutory body with a new governance structure. The regulator confirmed on 17 September 2026 that its office will be called the Information Commission's Office and will still be referred to as the ICO. References to the Information Commissioner in legislation and other documents are now read as references to the Information Commission.

For fee payers, that means:

The annual payment obligation continues and the exemptions are unchanged.
The three tiers and the £5 direct debit reduction are unchanged.
You do not need to register again or restart your charge period just because the regulator changed form.
Your renewal date stays tied to your existing 12-month charge period, not to 30 September 2026.

No immediate change to the ICO's branding or logo is expected. The new board is expected to issue a statement on naming conventions, and if organisations need to amend documents such as privacy notices as a result, it has said it will give a timeframe. If your privacy notice, contracts or payment mandate name the regulator, watch for that statement and update them when it arrives.

If you ever need to report a breach to the regulator, our guide on whether you need to notify the ICO of a data breach covers when and how.

Key takeaways

The UK GDPR does not require you to register your processing activities, but controllers with any non-exempt processing must pay the annual data protection fee and give the regulator basic details.
The exemptions are narrow. If any material activity falls outside them, such as CCTV or advisory work involving personal data about clients, the fee is payable.
The fee is £52 for Tier 1, £78 for Tier 2 and £3,763 for Tier 3, with £5 off for direct debit in every tier.
You self-assess your tier. Tier 1 applies if you have 10 or fewer staff or turnover of £632,000 or less, and you are treated as Tier 3 until you provide the information to show otherwise.
Each company in a group pays separately, and an innocent mistake has not been accepted as an excuse for missing the fee.
The Information Commission transition on 30 September 2026 did not change the fee, the tiers or your renewal date.

Frequently asked questions

Do I need to register with the ICO?

You do not register your processing activities. You do need to pay the annual data protection fee and give the regulator basic details, unless all of your processing is exempt.

How much is the ICO registration fee?

It is £52 for Tier 1, £78 for Tier 2 and £3,763 for Tier 3. Paying by direct debit takes £5 off in every tier.

Is the data protection fee compulsory?

Yes, if you are a controller with any processing that is not exempt. The regulator can issue a monetary penalty notice for non-payment, and the law caps the penalty at 150% of the highest fee.

Do sole traders and small limited companies have to pay?

They can. Size and legal structure do not decide it. What matters is whether you are a controller and whether all of your processing falls within an exemption, such as staff administration, accounts and records, or marketing your own business. A business with 10 or fewer staff, or turnover of £632,000 or less, pays the Tier 1 fee.

How do I find out which tier I am in?

You self-assess against the staff and turnover tests, and the regulator has an online tool to help. If you do not give the regulator enough information to establish a lower tier, it treats you as Tier 3.

When do I have to pay, and does the fee renew?

The fee is annual and falls due within the first 21 days of each 12-month charge period. Your renewal date follows your own charge period, not the calendar year.

Did the Information Commission change anything about the fee?

No. The fee, the tiers, the exemptions and your charge period are unchanged by the transition on 30 September 2026, and you do not need to register again.

Not sure which tier you fall into, or whether your processing is exempt? Plumlaw is a legal consultancy that helps founders and startups with data protection and day-to-day commercial risk. Get in touch with Plumlaw and we can point you in the right direction.

Do I Need to Pay the ICO Registration Fee? A Plain-English Guide for UK Founders