ICO fee checker: your data protection fee in seconds

How the fee tiers work

The Data Protection (Charges and Information) Regulations 2018 set three tiers, and each threshold is an either/or — one measure alone can qualify you for the lower tier:

• Tier 1 — £52 a year. Turnover of £632,000 or less, or 10 members of staff or fewer. Certain organisation types qualify for tier 1 regardless of size — the statutory categories are listed on the ICO fee guide.
• Tier 2 — £78 a year. If not tier 1: turnover of £36 million or less, or 250 members of staff or fewer.
• Tier 3 — £3,763 a year. Everyone else.

Each fee is reduced by £5 where you pay by direct debit — £47, £73 or £3,758 (reg 3(5)).

Does every company owe the fee?

No — and this is where companies most often get it wrong in both directions. A controller whose processing falls wholly inside the exempt categories in the Schedule to the regulations owes no fee. Most trading companies process personal data outside those categories and do owe it — but that is a fact about your processing, not a presumption. The exempt categories and what they cover are set out on the fee guide.

When is it due?

The charge covers a 12-month period, and renewal falls due on the anniversary of the date the fee was last paid. There is no reminder from anyone unless you set one up — which is exactly the kind of date the free calendar tracks for you.

What happens if you do not pay?

The ICO can issue a fixed penalty after its enforcement process. The amount is set by your tier: £400 for tier 1, £600 for tier 2 and £4,000 for tier 3. The Commissioner specifies these in a document published under section 158(1) of the Data Protection Act 2018 — they are flat amounts, not a percentage of your fee, and they did not change when the fees rose.

A penalty is not automatic, and there is a cure. The ICO issues a Notice of Intent first, giving you a deadline to pay or to make representations; pay the fee by that deadline and no penalty notice follows. The amounts above are what applies if the Commissioner does go on to issue one.

Why you may see £4,350 or £5,644.50 quoted

Section 158(3) caps what the Commissioner is allowed to specify at 150% of the highest tier charge, ignoring the direct debit reduction. On the current tier 3 charge of £3,763 that ceiling is £5,644.50. It is a limit on the Commissioner, not a figure you are charged — the fixed penalty amounts above apply if the Commissioner issues a penalty notice.

The ICO's own published material still states the ceiling as £4,350, which is 150% of £2,900 — the tier 3 charge as it stood before it rose on 17 February 2025.