The data protection fee is an annual charge that most organisations processing personal data electronically must pay to the UK's data protection regulator. It is £52 for micro organisations (tier 1), £78 for small and medium organisations (tier 2) and £3,763 for large organisations (tier 3), with £5 off for paying by direct debit. Since 30 September 2026 the fee has been paid to the Information Commission, which took over from the office of the Information Commissioner (the ICO).
Who has to pay the data protection fee
The fee comes from the Data Protection (Charges and Information) Regulations 2018. A data controller, meaning the organisation or sole trader that decides how and why personal data is used, must pay "unless all of the processing of personal data they undertake is exempt processing". Within "the first 21 days of each charge period" it must pay the charge and confirm its name and address, its staff numbers and turnover band, and whether it is a public authority.
For an organisation that becomes a controller now, the charge period is the 12 months starting on the date it became a controller, and each 12 months after that. In practice, a new business that keeps customer or staff records on a computer or phone should check its position in its first weeks of trading, not at its first year end.
The three tiers and the 2026/27 fees
| Tier | Who falls in it | Annual fee | By direct debit |
|---|---|---|---|
| Tier 1 (micro) | Turnover up to £632,000, or no more than 10 staff; also all charities and small occupational pension schemes | £52 | £47 |
| Tier 2 (small and medium) | Not in tier 1, and turnover up to £36 million or no more than 250 staff | £78 | £73 |
| Tier 3 (large) | Everyone else | £3,763 | £3,758 |
These amounts have applied since 17 February 2025, when the 2025 amendment regulations raised all three charges. Budget 2026, published on 28 October 2026, did not announce any change to them.
The tests are alternatives, and the lower tier wins. An organisation is in tier 1 if it meets either the turnover test or the staff test, so a company with 30 staff and £500,000 of turnover pays £52, as does a two-person company turning over £5 million. Public authorities are tiered on staff numbers alone; the turnover tests are "to be disregarded" for them.
How staff and turnover are measured
- Staff. "Members of staff" means employees, workers, office holders and partners, so directors count. The number is an average: add up the headcount for each completed month of the financial year and divide by the number of months;
- Turnover. For a company, turnover has its Companies Act 2006 meaning: the amounts derived from providing goods and services, after deducting trade discounts, VAT and other taxes based on those amounts;
- Which year. Both are measured for the most recent financial year that ended before the charge period starts, or for the whole period of the organisation's existence if it is less than 12 months old.
Exemptions
The Schedule to the 2018 Regulations lists the processing that is exempt. The most relevant to businesses are processing:
- Not done electronically. Personal data that is not processed by automated means, or recorded with that intention, such as purely paper records;
- Staff administration. Administering your own staff, volunteers and contractors;
- Your own marketing. Advertising, marketing and public relations for your own business, goods or services;
- Accounts and records. Keeping accounts or records of purchases, sales and other transactions, deciding whether to accept a customer or supplier, and financial forecasting, unless the data comes from a credit reference agency;
- Not-for-profit membership. Processing by a not-for-profit body to maintain its membership or support, or to run activities for its members and regular contacts;
- Personal affairs and public registers. Processing for personal, family or household affairs, and processing to maintain a public register.
The trap is the word "all". The exemption applies only if every piece of processing falls within the list. A small business that uses personal data for any purpose outside it, for example operating CCTV for security or using data obtained from a credit reference agency, has to pay, even if most of what it does is exempt.
Penalties for not paying
Under section 158 of the Data Protection Act 2018, the regulator publishes a schedule of fixed penalties for failing to pay. The law caps the penalty at "150% of the highest charge payable by a controller", ignoring any discount. With the tier 3 charge at £3,763, the statutory maximum is £5,644.50. The regulator "may specify different amounts for different types of failure", so the penalty actually charged depends on its published schedule, but even the cap is well over the cost of paying on time.
Worked example
An accountancy practice has 14 staff and turnover of £1.1 million in the financial year that ended before its charge period. It is outside tier 1 on both tests: turnover is over £632,000 and staff are over 10. It is inside tier 2 on both. The fee is £78, or £73 if it pays by direct debit. If its average headcount had been 10 or fewer, it would have been in tier 1 at £52, whatever its turnover.
The fee and the wider rules
Paying the fee is not the same as complying with data protection law. It registers you with the regulator; it does not cover your obligations under the UK GDPR to process data lawfully, keep it secure and report breaches. Those are covered in our guides to what UK GDPR means and UK data privacy regulations, and larger organisations may also need a data protection officer. Following the change of regulator, the charge regulations now name the Information Commission as the body to pay.
Primary sources: the Data Protection (Charges and Information) Regulations 2018 (regulations 1 to 3 and the Schedule, as amended), and Data Protection Act 2018 s158.
If you are unsure whether your processing is exempt, or which tier you are in, our GDPR audit team can review how you use personal data, and our accountants for small businesses can confirm the turnover and staff figures the tier depends on.