The Information Commissioner's Office

The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and privacy, responsible for enforcing the UK GDPR and the Data Protection Act 2018. Its role includes helping organisations understand and comply with data protection laws, investigating complaints, and taking enforcement action where needed.

ICO Data Protection Fee

By law, under the Data Protection (Charges and Information) Regulations 2018, organisations that handle personal information electronically, such as people’s names and addresses, must register with the ICO and pay the annual data protection fee, unless they qualify for an exemption.

Who Needs to Pay the Fee?

The obligation to pay the fee is determined by how your organisation uses personal information for work purposes. For example, if you store personal information on a computer or phone, you must check whether you need to pay the data protection fee. If you use CCTV or dashcams, you are likely to need to pay.

Fee Amount and Applicability

The fee amount is based on your organisation’s nature, size, and turnover. For those with 10 or fewer employees, the fee is currently £52 per year. The data protection fee applies to all organisations, from sole traders and independent practitioners to small businesses and charities, all the way up to global multinationals.

Purpose of the Data Protection Fee

The data protection fee funds the ICO’s work, which includes giving organisations practical tools that empower them to use people’s information responsibly and transparently. In turn, this enables the public to exercise their information rights.

Consequences of Non-Payment

It’s important to pay the data protection fee, unless you’re exempt, to avoid a fine of up to £4,350.

How to Determine if You Need to Pay

You can use the ICO’s online self-assessment, which will guide you through some questions about how your organisation uses data, to determine whether you need to pay. Use the following link to check if you need to pay, or if you are exempt: ico.org.uk/fee-checker. Follow the instructions to register and pay the fee if you need to.

How the ICO Helps SMEs

SMEs often have limited time and expertise for data protection. The ICO provides practical, jargon‑free support designed especially for small businesses, sole traders, start-ups, charities, and clubs.

Key ways the ICO supports SMEs include:

• Making Data Protection Easier to Understand
  • Simplified guidance to help SMEs confidently use personal data lawfully.
  • Bite-sized educational materials and tips designed for people with limited data‑protection knowledge
• Practical Tools to Support Compliance
  • Self‑serve tools to check if UK GDPR applies, whether fees must be paid, and whether a breach must be reported. - [ico.org.uk]
  • A “Getting Started with Data Protection” step‑by‑step guide and compliance checklists.
• Direct Support and Advice
  • A business advice helpline for questions that require deeper discussion. - [ico.org.uk]
  • A live chat service for simpler, quick queries. - [ico.org.uk]
  • Email support for fee, registration, or general compliance questions. - [ico.org.uk]
• Helping SMEs Avoid Risks
  • Guidance on preventing data breaches and responding correctly to Subject Access Requests (SARs). - [ico.org.uk]
  • Support to build trust, improve security, avoid fines, and protect reputation.

Data Protection Essentials

Data Protection Essentials is a free online training and self-assessment programme from the Information Commissioner's Office (ICO), designed specifically for small organisations and sole traders. It helps businesses understand their data protection responsibilities, improve how they manage personal information, and build confidence in complying with UK data protection law. The programme includes short, practical learning modules, tailored guidance, and digital certificates on completion, making it a straightforward way for smaller businesses to strengthen their data protection practices.

Key ICO Resources Available for SMEs

SME Web Hub (Main SME Resource Centre)

A dedicated hub offering:

• Getting started guides
• Information security best practices
• Direct marketing rules
• SAR guidance
• Privacy notices & cookie guidance
• CCTV & dashcam use compliance

Access the hub here >