What is the data protection fee, and do you have to pay it?
Every organisation and sole trader that processes personal data must pay an annual fee to the regulator unless an exemption applies. From 2025-02-17 the fee is £52 (tier 1), £78 (tier 2) or £3,763 (tier 3), depending on turnover and staff numbers, less £5 if you pay by direct debit.
What it is
The fee funds the regulator and puts you on its public register of fee payers. It is set by the Data Protection (Charges and Information) Regulations 2018 under DPA 2018 s.137, as amended in 2025. Since 2026-09-30 it is paid to the Information Commission, which took over from the Information Commissioner.
Which tier you are in
- Tier 1, £52: turnover of £632,000 or less, or 10 or fewer staff, or a charity, or a small occupational pension scheme. SI 2018/480 reg 3; SI 2025/63
- Tier 2, £78: turnover of £36 million or less, or 250 or fewer staff. SI 2018/480 reg 3; SI 2025/63
- Tier 3, £3,763: everyone else. Public authorities are tiered by staff numbers only. SI 2018/480 reg 3; SI 2025/63
When you do not have to pay
- You process personal data only for staff administration, your own advertising, marketing and PR, or keeping accounts and records.
- You are a not-for-profit organisation processing only for your own purposes, or you maintain a public register.
- You process only for personal, family or household affairs, judicial functions, or without automated means, or as an elected representative.
Who is responsible
The controller. Processors pay only for any processing they carry out as a controller.
What it involves
- Check the exemptions against everything you process.
- Work out your tier from turnover and staff on the first day of the charge period.
- Pay annually, by direct debit to save £5.
- Keep your register entry up to date.
Timing
Annually, from the start of processing.
If it goes wrong
- Regulatory
- The regulator can issue a fixed penalty for non-payment: £400 for tier 1, £600 for tier 2 and £4,000 for tier 3, rising to a maximum of £4,350 with aggravating factors (DPA 2018 ss.155 and 158).
- Criminal
- No offence. Non-payment was a criminal matter under the old notification regime but is now a civil penalty.
- Civil
- None.
Go further
- The law
- DPA 2018
- Guides
- Policy frameworks and standards
More on duties on organisations
- What is a data protection officer, and when must you appoint one?
- What is a UK representative, and who needs one?
- What is a privacy notice, and what must it say?
- What is a data processing agreement, and when is one required?
- What is a data sharing agreement, and when should you have one?
- What is data protection by design and by default?
Sources
- Primary Data Protection (Charges and Information) Regulations 2018, regulation 3 legislation.gov.uk
- Primary Data Protection Act 2018, section 137 legislation.gov.uk
- Secondary Fee payable to the ICO to increase in February Lewis Silkin
- Secondary ICO fees and GDPR fines for small businesses and sole traders Briffa
Updated