By law, under the Data Protection (Charges and Information) Regulations 2018, organisations that handle personal information electronically, such as people’s names and addresses, must register with the ICO and pay the annual data protection fee, unless they qualify for an exemption.

The obligation to pay the fee is determined by how your organisation uses personal information for work purposes. For example, if you store personal information on a computer or phone you must check whether you need to pay the data protection fee. If you use CCTV or dashcams, you are likely to need to pay.

The fee amount is based on your organisation’s nature, size, and turnover. For those with 10 or fewer employees, the fee is currently £40 per year.

The data protection fee applies to all organisations, from sole traders and independent practitioners to small businesses and charities, all the way up to global multinationals.

Why is there a data protection fee?

The data protection fee funds the ICO’s work, which includes giving organisations practical tools that empower them to use people’s information responsibly and transparently. In turn, this enables the public to exercise their information rights.

What happens if I don’t pay the fee when I should?

It’s important to pay the data protection fee, unless you’re exempt, to avoid a fine of up to £4,000.

How do I pay or check if I’m exempt?

You can use the ICO’s online self-assessment, which will guide you through some questions about how your organisation uses data, to determine whether you need to pay.

Follow these simple steps:

• Use this link to check if you need to pay, or if you are exempt.
• Follow the instructions to register and pay the fee if you need to.

For more information about the fee, you can read the ICO’s frequently asked questions.

Alternatively, you can speak to the ICO fees team via live chat on their website, or call their fees helpline on 0303 123 1113.

The ICO has a range of handy guides, tools, and checklists to help organisations use people’s information confidently and comply with data protection law. You can access these on the ICO’s web hub for small organisations.

By the Information Commissioner’s Office (ICO), the UK regulator for data protection.