ICO data protection fee 2026: who pays, how much, and exemptions

What the fee is

Under the Data Protection (Charges and Information) Regulations 2018, every organisation or sole trader that processes personal data as a “controller” must pay a data protection fee each year, unless an exemption applies. A controller is whoever decides why and how personal data is used. For most small businesses, that’s you.

GOV.UK’s page on registering with the ICO confirms this covers sole traders as well as companies. The fee is paid to the ICO. Since 30 September 2026 the regulator has been the Information Commission, but it is still called the ICO and the fee works in the same way.

How much it costs

These amounts have applied since 17 February 2025, set by SI 2025/63. They come from regulation 3 of the 2018 Regulations and are shown on the ICO’s fee page:

Tier	Who	Annual fee
Tier 1 (micro)	Annual turnover of £632,000 or less, or no more than 10 members of staff	£52
Tier 2 (small and medium)	Annual turnover of £36 million or less, or no more than 250 members of staff	£78
Tier 3 (large)	Everyone else	£3,763

The ICO takes £5 off if you pay by direct debit. Before February 2025 the tiers were £40, £60 and £2,900, so older blog posts may show those figures.

A few points from the ICO’s guidance:

You only need to meet one of the two tests (turnover or staff) for a tier.
Charities and small occupational pension schemes pay the tier 1 fee whatever their size.
Until you tell the ICO your turnover and staff numbers, it treats you as tier 3.
The fee is annual, so you pay it again each year.

Are you exempt?

The Schedule to the 2018 Regulations lists exempt processing. The ICO summarises it on its exemptions page. You’re exempt only if all the personal data you process falls into exempt categories. The main ones for small businesses are:

Staff administration: payroll, HR and staff records.
Advertising, marketing and public relations for your own business.
Accounts and records: keeping accounts, deciding whether to accept customers or suppliers, and business forecasting.
Not-for-profit purposes, for certain bodies.
Processing that isn’t done on a computer or other automated equipment.
Personal, family or household affairs.

Some ordinary activities take you outside the exemptions. A common one is CCTV: the ICO’s advice for small businesses says that if you use CCTV for crime prevention, you are likely to need to pay. Other uses of customer data, beyond marketing and accounts, can do the same.

The quickest way to check is the ICO’s fee self-assessment tool. Being exempt from the fee doesn’t exempt you from the rest of data protection law. You still need a privacy notice, security and a way to handle complaints.

What happens if you don’t pay

The ICO can issue a monetary penalty. Its published fixed penalties are £400 for tier 1, £600 for tier 2 and £4,000 for tier 3. With aggravating factors the maximum is £4,350 (see the ICO’s penalties page). The penalty is on top of the fee you still owe.

How to check whether you’re registered

The ICO publishes a public register of fee payers. Search for your business name or postcode. If you think you’ve paid but can’t find yourself, check the name matches the one you registered (sole traders are often listed under their own name), then contact the ICO.

Pay through the ICO’s own website. If anyone else asks you for a “data protection registration” payment, check it against ico.org.uk before you pay anything.

Quick checklist

Decide whether any of your processing falls outside the exemptions (CCTV is a common one)
Use the ICO self-assessment tool if you’re unsure
Work out your tier from turnover or staff numbers
Pay through the ICO website, by direct debit for the £5 discount
Search the ICO register to confirm your entry
Put the renewal in your calendar
Remember the fee isn’t the whole job: you still need a privacy notice and complaints process

FAQ

How much is the ICO data protection fee in 2026?

Tier 1 is £52, tier 2 is £78 and tier 3 is £3,763 a year. These amounts have applied since 17 February 2025. The ICO takes £5 off if you pay by direct debit.

Do sole traders have to pay the ICO fee?

Yes, if they process personal data as a controller and no exemption applies. GOV.UK says this applies to sole traders as well as companies.

I only use customer details for marketing and accounts. Am I exempt?

Possibly. Processing for your own advertising, marketing and public relations, and for keeping accounts and records, is exempt. But you are only exempt if all of your processing is exempt, so something like CCTV for crime prevention would mean you need to pay. Use the ICO self-assessment tool to check.

What is the penalty for not paying?

The ICO’s fixed penalties are £400 (tier 1), £600 (tier 2) and £4,000 (tier 3), up to a maximum of £4,350 with aggravating factors. You still have to pay the fee itself.

How do I check whether a business has paid?

Search the ICO’s public register of fee payers on ico.org.uk by business name or postcode.

Official sources

Laws and guidance change. Check the sources above for the latest position. For advice on your own circumstances, consult a solicitor.