ICO registration and data protection fee

What's included

• The £52 tier 1 data protection fee
• Run-through of the ICO exemption questions with you
• Confirmation of your fee tier
• Preparation and submission of the registration
• Registration number and certificate sent to you
• Data protection contact details set up correctly
• Reminder before your yearly renewal
• Plain-English explanation of what registration does and does not cover

Who must pay the data protection fee

Under the Data Protection (Charges and Information) Regulations, organisations and sole traders that decide how personal data is used — known as "controllers" — must pay a fee to the ICO every year, unless they are exempt. Personal data includes customer names and emails, staff records, and CCTV footage of people.

Many small businesses need to pay, for example if they keep customer details on a computer or phone, use CCTV, or process personal data for anything beyond the most basic administration. A new limited company that will hold any customer or supplier contact details should check straight away.

The exemption questions

Some organisations do not have to pay. The ICO runs a self-assessment with a short set of questions about what you use personal data for. Exemptions can apply, for example, where personal data is used only for:

• your own staff administration
• advertising, marketing and public relations for your own business
• your own accounts and records

Some not-for-profit organisations are also exempt. The answers depend on your activities, so we go through the questions with you before anything is paid. If you are exempt, we tell you and you do not need this service.

The fee tiers

• Tier 1 (micro): turnover up to £632,000 or no more than 10 staff — £52 a year
• Tier 2 (small and medium): turnover up to £36 million or up to 250 staff — £78 a year
• Tier 3 (large): everyone else — £3,763 a year

Charities and small occupational pension schemes pay tier 1. The ICO assumes tier 3 unless you tell it otherwise, so it matters to give the right figures.

Our £149 includes the £52 tier 1 fee. If you are tier 2, we charge the £26 difference before submitting. If you are tier 3, we confirm the cost with you before we pay anything.

How it works

1. Order online and tell us about your business.
2. We go through the exemption questions and confirm your tier.
3. We prepare the registration with your company details and a data protection contact.
4. We submit it and pay the fee.
5. We send you the registration number and certificate.

What you need to provide

• company name, number and registered office
• turnover and number of staff, to confirm the tier
• a contact person and email for data protection matters
• a short description of the personal data you handle

Renewal every year

The fee is yearly. Your registration must be renewed each year to stay on the ICO's public register. We remind you before it is due.

Penalties for not paying

The ICO can issue a fixed penalty to a controller that should have paid and did not: £400 for tier 1, £600 for tier 2 and £4,000 for tier 3. Where there are aggravating factors, it can raise the penalty up to a maximum of £4,350.

What registration does not do

Paying the fee does not make your business compliant with UK GDPR on its own. You still need, for example, a privacy notice and sensible data security. We do not give legal advice on data protection; for complex processing, speak to a specialist. The ICO is also due to be renamed the Information Commission; the fee amounts are unchanged.

ICO registration is often one of the first steps after forming a company, alongside a business email and a one-page website. See Fully Inclusive Package for other registrations we can handle when you form your company.

Frequently asked questions

Related services