- The three ICO fee tiers
- The tier 3 default most people don't know about
- Who counts as a member of staff
- Who doesn't have to pay
- A quick example of working out your tier
- Paying and renewing
- What happens if you don't pay
- How to pay the ICO fee, step by step
- Plain advice on the ICO fee
- Frequently asked questions
UK organisations, including sole traders, that use personal information must pay the ICO data protection fee every year, unless they're exempt. As of October 2026 it's £52 for micro organisations (tier 1), £78 for small and medium organisations (tier 2) and £3,763 for large organisations (tier 3), with £5 off if you pay by direct debit.
This is one of those small admin jobs that catches out new businesses, because the fee is low but the penalty for missing it isn't. I read the Information Commissioner's Office guide to the data protection fee, its exemptions page, its FAQs and its penalties page, so everything here comes straight from the ICO.
The three ICO fee tiers
| Tier | Who it's for | Fee |
|---|---|---|
| Tier 1, micro organisations | Turnover up to £632,000 or no more than 10 members of staff | £52 |
| Tier 2, small and medium organisations | Turnover up to £36 million or no more than 250 members of staff | £78 |
| Tier 3, large organisations | Everyone who doesn't meet tier 1 or tier 2 | £3,763 |
You only need to meet one of the two tests for a tier, turnover or staff numbers. Charities and small occupational pension schemes that aren't exempt only pay the tier 1 fee, whatever their size, and public authorities work out their tier from staff numbers alone.
The tier 3 default most people don't know about
The ICO says it regards every controller as eligible to pay the tier 3 fee unless and until they tell it otherwise. In plain terms, if you don't give the ICO your turnover or staff numbers, it can assume you're a large organisation. So when you register, give your details so you're placed in the right tier.
Who counts as a member of staff
The ICO defines members of staff broadly. It includes employees, workers, office holders and partners, and you use the average number working for you during your financial year. So anyone who works for you counts, not just people on your payroll.
Who doesn't have to pay
You don't need to pay the fee if you only process personal data for one or more of these purposes:
- Staff administration.
- Advertising, marketing and public relations.
- Accounts and records.
- Not-for-profit purposes.
- Personal, family or household affairs.
- Maintaining a public register.
- Judicial functions.
- Processing personal information without an automated system such as a computer.
The key word is only. If you use personal data for anything beyond these purposes, the exemption doesn't cover you. The ICO's online self-assessment tells you whether you need to pay, and it's worth doing even if you think you're exempt. The ICO also points out that being exempt from the fee doesn't exempt you from the rest of data protection law.
A quick example of working out your tier
Picture a small studio with a handful of staff and turnover well under the tier 1 limit. It meets both tier 1 tests, so it pays £52, less the £5 discount if it pays by direct debit. If the studio grew past 10 members of staff, it would no longer qualify for tier 1 on staff numbers, but it could still be tier 1 on turnover if that stayed under £632,000. Either test is enough, so check both.
Paying and renewing
- Pay by direct debit and you get an automatic £5 discount.
- The fee covers 12 months from your renewal date, not the date you pay.
- You pay every 12 months, and the ICO contacts you before your renewal is due.
- There's no VAT on the fee, because statutory fees are outside the scope of VAT.
- Refunds are only given in exceptional circumstances.
What happens if you don't pay
The ICO's penalties page is blunt: if you process personal data for a non-exempt purpose and haven't paid, or haven't paid the correct fee, you're breaking the law. The maximum penalty is a £4,350 fine. The ICO's FAQs say it sends a reminder first, and if you still don't pay or explain why you no longer need to, it can issue a notice of intent to fine you 28 days after your payment expires.
How to pay the ICO fee, step by step
- Run the ICO's fee self-assessment to check whether you need to pay.
- Work out your tier from your turnover or staff numbers.
- Register on the ICO website and choose direct debit to get the £5 discount.
- Note your renewal date so you're never left uncovered.
If you collect leads or run a sales team, my guide to GDPR for sales teams covers the day-to-day rules, and this explainer on whether Google Analytics needs cookie consent is worth reading if you track your website.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Plain advice on the ICO fee
If you run a small business that keeps customer details on a laptop or in the cloud for anything beyond marketing and accounts, assume you need to pay, then let the self-assessment prove otherwise. Pay by direct debit, which saves £5 and means you'll never miss a renewal. For most small businesses it's one of the simplest compliance jobs on the list.
Do you make privacy or compliance software? Tool makers can ask to be considered for a featured mention in guides like this one.
Frequently asked questions
How much is the ICO data protection fee?
As of October 2026, the ICO lists £52 for tier 1, £78 for tier 2 and £3,763 for tier 3, with £5 off if you pay by direct debit.
Do sole traders have to pay the ICO fee?
Yes, unless they're exempt. The ICO says organisations, including sole traders, that use personal information need to pay unless an exemption applies.
Who is exempt from the ICO fee?
You're exempt if you only process personal data for purposes such as staff administration, advertising and marketing, accounts and records, not-for-profit purposes or personal affairs, or without a computer.
How often do you pay the ICO fee?
Every 12 months. The fee covers 12 months from your renewal date, not your payment date.
What is the fine for not paying the ICO fee?
The ICO says the maximum penalty is a £4,350 fine.
Is VAT charged on the ICO fee?
No. The ICO says statutory fees are outside the scope of VAT.
