Data protection fee: do you have to pay the ICO, and how much?

Most small business owners have heard of the ICO data protection fee, and many are unsure whether it applies to them. Some have received a letter or email about it and wondered whether it was real. This post sets out what the law says, what it costs, who is exempt and what to do this week, using the government's own figures and the regulations themselves.

What the fee is

Organisations that process personal data generally have to pay an annual data protection fee to the Information Commissioner's Office (ICO), unless an exemption applies. Personal data simply means information about identifiable people, such as customer names, email addresses, delivery addresses or staff records. If your business takes online orders, keeps a mailing list or holds customer details in a booking system, you are processing personal data.

The fee is set by the Data Protection (Charges and Information) Regulations 2018. Do not confuse it with GDPR compliance in general. Paying the fee does not make you compliant, and being exempt from the fee does not exempt you from the rules on how you handle data.

What it costs in 2026

The government raised the fees by 29.8 per cent in its January 2025 consultation response, below the 37.2 per cent it first proposed. Law firm Lewis Silkin reports that the new amounts came into force on 17 February 2025. Regulation 3 of the 2018 Regulations now gives these annual charges:

• Tier 1 (micro organisations): £52
• Tier 2 (small and medium organisations): £78
• Tier 3 (large organisations): £3,763

Tier 1 applies if your turnover is £632,000 or less, or you have 10 or fewer staff. It also covers charities and small occupational pension schemes. Tier 2 applies if you are not in Tier 1 and your turnover is £36 million or less, or you have 250 or fewer staff. Everyone else is in Tier 3. Turnover and staff numbers are measured on the first day of the charge period.

The regulations also say the charge is reduced by £5 if you pay by Direct Debit. So a Tier 1 business paying by Direct Debit pays £47, not £52. For most small firms, then, this is a modest annual cost, not a large one.

Who does not have to pay

The Schedule to the Regulations lists exempt processing. If you process personal data only for exempt purposes, you do not pay the fee. The categories most relevant to small businesses are:

• administering staff, volunteers and contractors
• advertising, marketing and public relations for your own business
• keeping accounts and transaction records, deciding whether to accept customers or suppliers, and financial forecasting
• personal, family or household activities
• manual records that are not processed by automated means and are not meant to be

There are further exemptions for not-for-profit bodies handling membership and support, for elected representatives and for some judicial functions. Credit reference agencies are specifically excluded from the accounts and customers category.

The key word is "only". The exemption applies where the data is used solely for those purposes. A business that uses a customer database for anything outside them, such as running a loyalty app, CCTV or an online account system, should not assume it is exempt without checking. That is why it is worth checking your position against the ICO's own guidance on its website, and keeping a note of what you decided and when, particularly if you conclude that you do not need to pay.

Spotting a fake

Letters and emails about data protection fees are an obvious target for fraudsters, because many owners are unsure whether they owe anything and a demand that looks official can prompt a quick payment. The defence is to know the real figures: for a small business they are £52 or £78 a year, not hundreds.

A sensible approach is to treat any demand for payment with suspicion and to avoid using contact details printed on it. Instead:

• Go to the ICO's website yourself by typing the address into your browser.
• Compare any amount demanded with the figures above. A demand far above £78 for a small business is a warning sign.
• Never pay through a link in an unexpected email or text. If in doubt, ask whoever manages your IT or accounts.

The same caution applies to scam messages generally. Our guides on HMRC scam messages and invoice fraud cover the habits that protect you.

What happens if you do not pay

The fee is a legal requirement, not a voluntary registration, and the ICO can issue penalties to organisations that should pay and do not. A 2019 Irwin Mitchell article reported that the ICO had issued more than 900 notices of intent to fine and had fined over 100 unregistered controllers by then. That is dated, so check the ICO's current guidance for today's penalty amounts. The practical point is that being unregistered is the sort of problem that is cheap to fix and expensive to ignore.

Your checklist for this week

• List where your business keeps personal data: website forms, booking or ordering systems, email lists, staff records.
• Check your position against the ICO's guidance on its website and write down the outcome and the date.
• If you must pay, pay directly through the ICO website, by Direct Debit if you can, to save £5 and avoid missed renewals.
• Set a calendar reminder a month before renewal.
• If you are exempt, make sure your privacy information and data handling still meet the rules. Exemption from the fee is not exemption from the law.
• Tell colleagues who open the post or the shared inbox how to recognise a genuine ICO message.

If your website collects orders or bookings, the systems behind it are part of this picture. Our cloud and security work includes helping businesses see where their customer data actually lives, which makes this kind of check much quicker.

The short version

If you handle personal data beyond the narrow exempt purposes, expect to pay £52 or £78 a year, or £5 less by Direct Debit. If you believe you are exempt, check it against the ICO's guidance and keep a record. Either way, deal with ICO matters through the ICO's own website and never through a link or phone number in an unexpected demand.