ICO registration fee: what you pay, who is exempt, and what happens if you do not

The ICO registration fee — formally the data protection fee — is £52, £78 or £3,763 a year depending on your tier, with £5 off for direct debit. Not every organisation owes it: processing that falls wholly within eleven exempt categories attracts no fee at all.

What is the ICO registration fee?

An annual charge payable to the Information Commissioner by controllers who process personal data. It is set by the Data Protection (Charges and Information) Regulations 2018, and the tiers and amounts are in regulation 3.

It is a fee, not a penalty and not a licence. Paying it does not approve, authorise or endorse your data processing — it is a charge that funds the regulator, and the obligation is simply to pay it if you fall within scope.

How much is the ICO fee?

Three tiers, set by regulation 3(1):

The direct debit reduction is exactly £5.00, under regulation 3(5). It applies to every tier at the same flat amount, which makes it proportionally significant at tier 1 and negligible at tier 3.

Which ICO fee tier am I in?

The tests are in regulation 2, and they are applied in order:

• Tier 1 applies where turnover is £632,000 or less or staff numbers are 10 or fewer. It also applies where the controller is a charitable body or a small occupational pension scheme, regardless of size.
• Tier 2 applies, if you are not in tier 1, where turnover is £36 million or less or staff numbers are 250 or fewer.
• Tier 3 is everyone else.

Note the or in each tier, which is generous rather than restrictive: meeting either limb is enough. A business with 8 staff and £5 million of turnover is still tier 1 on the staff limb alone. Reading these as "and" tests puts organisations into a higher tier than the regulations do.

The thresholds are also inclusive — "£632,000 or less", "10 or fewer" — so an organisation sitting exactly on a number is inside the lower tier, not outside it.

Do I need to pay the ICO fee?

Only if you are a controller processing personal data and not all of your processing is exempt. If every activity you carry out falls within the exempt categories, no fee is owed.

That is a real exemption, not a technicality — but it is narrower than it looks for most trading companies, because it has to cover all your processing, not merely some of it.

What processing is exempt from the data protection fee?

The Schedule to the regulations sets out eleven categories of exempt processing at paragraph 2(2):

1. Processing that is not wholly or partly automated, and is not recorded with the intention that it be so
2. A controller's personal, family or household affairs, including recreational purposes and the capturing of images in a public space
3. Maintenance of a public register
4. Matters of administration in relation to staff, volunteers and persons working under a contract for services
5. Advertising, marketing and public relations in respect of the controller's own business, activity, goods or services
6. Keeping accounts or records of purchases, sales or other transactions, deciding whether to accept a person as customer or supplier, and financial or financial management forecasts
7. A not-for-profit body or association establishing or maintaining membership or support, or providing or administering activities for members or those in regular contact with it
8. A judge, or a person acting on a judge's instructions or behalf, exercising judicial functions — including the appointment, discipline, administration or leadership of judges
9. A member of the House of Lords entitled to receive writs of summons, or a person acting on their instructions or behalf, exercising the member's functions as such
10. An elected representative, or a person acting on their instructions or behalf, exercising that representative's functions as such
11. A prospective representative — a person seeking to become or remain an elected representative — or a person acting on their instructions or behalf, in connection with activity reasonably regarded as intended to promote or procure their election or re-election

Categories 9 to 11 are the ones most often missed. Paragraph 2(2)(i) to (k) were inserted with effect from 1 April 2019 by S.I. 2019/478, so any list compiled from the Schedule as originally made stops at eight.

Three qualifiers travel with that list:

• "Elected representative" is a defined term with a deliberate gap in it. Paragraph 1 defines it by reference to paragraph 23(3)(a) to (d) and (f) to (m) of Schedule 1 to the Data Protection Act 2018. Sub-paragraph (e) is excluded from the definition — the range is written to leave it out, not to include it by implication.
• A disclosure on its own does not break the exemption. Under paragraph 2(1)(b), processing is still treated as exempt where it falls outside one of the descriptions solely because of a disclosure made for a reason listed in paragraph 2(3).
• Credit reference data is carved out. Paragraph 2(4) excludes credit-reference-agency data from the category 6 description.

A controller whose processing falls wholly inside these owes no fee. Most trading companies process personal data outside them somewhere — CCTV, marketing analytics, customer profiling — but that is a question about your actual activities, not a presumption anyone can make for you.

The categories are listed here in full rather than summarised, because an exemption you were never told about is functionally the same as one that does not exist.

When is the ICO fee due?

Annually, for each charge period of 12 months. Renewal falls due on the anniversary of the date the fee was last paid — not on a fixed date in the calendar, and not on your financial year end.

That makes it a rolling, organisation-specific date. It is also the reason the renewal is so widely missed: nothing in your accounting cycle coincides with it, so unless it is tracked deliberately it arrives unannounced.

How do I check the ICO register?

The Information Commissioner maintains a public register of fee payers, and it is searchable by organisation name or registration number. Checking it is the fastest way to answer three separate questions:

• Whether your own registration is current — and, if it is, the date it renews, which is the date you need to track.
• Whether a supplier or processor you are about to share personal data with is registered. This is a routine part of supplier due diligence, and it costs nothing.
• Whether a business contacting you is who it says it is — a registered entry shows a registered name and address.

An entry on the register records that the fee has been paid. It is not an assessment of the organisation's data protection practices, and it should not be read as one.

What is the penalty for not paying the data protection fee?

If you do not pay, the ICO issues a fixed penalty set by the tier you fall in: £400 for tier 1 (micro), £600 for tier 2 (small and medium), £4,000 for tier 3 (large). These are set by the Information Commissioner in a document published under section 158(1) of the Data Protection Act 2018 and laid before Parliament, not by the fee regulations themselves.

You will usually get a chance to avoid the penalty entirely. The ICO issues a notice of intent first; pay the fee by the deadline it gives and no penalty notice follows.

Why you may see £4,350 or £5,644.50 quoted

Section 158(3) caps what the Commissioner is allowed to specify at 150% of the highest tier charge, ignoring the direct debit reduction. On the current tier 3 charge of £3,763 that ceiling is £5,644.50. The ICO's published material still states it as £4,350 — 150% of £2,900, the tier 3 charge before it rose on 17 February 2025.

Neither is what a business that has not paid its fee is charged. The ceiling limits what the Commissioner may set; the fixed penalties above are what is actually issued. The ICO reserves the right to go up to the ceiling in one narrower case — where a controller fails to give it enough information to work out the right fee or exemption, with aggravating factors such as refusing to engage.

What changed recently?

The amounts themselves. The Data Protection (Charges and Information) (Amendment) Regulations 2025 (S.I. 2025/63) substituted the three tier charges with effect from 17 February 2025 — the first change since the fee was introduced. The £5.00 direct debit reduction at regulation 3(5) and the tier thresholds at regulation 2 were untouched, and were re-verified against the current consolidated text. The section 158(3) multiplier and its disregard of the discount were read from the Act itself — which is why the derived maximum moved with the tier 3 charge.

How do I pay the ICO fee?

Directly to the Information Commissioner's Office, selecting the tier your turnover and staff numbers put you in. Direct debit both reduces the fee by £5 and removes the renewal-date problem — which, given that the renewal anniversary is tied to your own last payment date rather than to anything else in your year, is the larger of the two benefits.

Related

• Confirmation statement · Annual accounts — the Companies House deadlines on the same calendar
• Pillar hub: UK data protection obligations (placeholder)
• ICO fee checker — work out your tier and see what you owe
• Companies House deadline checker — enter your company number for your filing deadlines