Pay the data protection fee to the Information Commission

Who must register

If your business processes personal data, you are legally required to pay an annual data protection fee to the Commission. This obligation comes from the Data Protection (Charges and Information) Regulations 2018.

Personal data includes customer names, email addresses, employee records, supplier contacts, CCTV footage, website analytics, and marketing lists. If you hold any information about identifiable living people for business purposes, you are processing personal data.

You must register if your business:

• Keeps customer or client contact details
• Has employees or workers (including payroll and HR records)
• Uses CCTV, dashcams, or smart doorbells for business purposes
• Maintains marketing or mailing lists
• Uses website analytics or cookies that identify visitors
• Processes supplier or contractor information

In practice, almost every business needs to register. If you run a business and keep any records about people, you should register.

Limited exemptions

You may be exempt from paying the fee only if you:

• Only process personal data for personal, family, or household purposes (not for any business activity)
• Are an elected representative processing data solely for that role
• Have no automated processing at all (no computers, databases, or CCTV) - extremely rare in practice
• Only process data for judicial functions
• Only process personal data to administer staff, market your own business, or keep accounts and records

These exemptions are interpreted very narrowly. If in doubt, register. The penalty for not registering far exceeds the annual fee.

Understand the fee tiers

The data protection fee uses a three-tier structure based on your staff numbers and annual turnover. You pay the tier that matches your highest category.

How to work out your tier

Staff count:

• Include employees, workers, office holders, and partners
• Use your average headcount across the financial year
• Part-time workers count as one person each (not pro-rated)
• Agency workers generally count towards the agency, not your organisation

Turnover:

• Use your total annual turnover (gross income from all activities)
• For new businesses, use your expected first-year turnover
• Each legal entity in a group registers and pays separately

All registered charities pay Tier 1 (£52) regardless of size or turnover.

How to register

Registration is done online through the Commission website. The process takes approximately 10 to 15 minutes.

Information you will need

Before starting, gather:

• your legal name, any trading names and your registered address
• your company registration number, if you are a limited company
• the name, email and phone number of the person responsible for data protection
• a description of what personal data you hold and why
• your staff numbers and turnover, to set your tier
• a debit or credit card, or bank details for Direct Debit

After registration

Once registered, your details appear on the Commission's public register within a few working days. Anyone can search the register to verify your registration, which is often checked during due diligence by larger clients and during contract negotiations.

Annual renewal

Your registration lasts 12 months. The Commission sends a renewal reminder before your expiry date.

If you pay by Direct Debit

Renewal is automatic. The Commission collects payment and issues a new registration certificate without any action from you.

If you pay by card

You must renew manually each year:

• The Commission sends email and postal reminders before expiry
• Log in to your Commission account to pay
• Complete payment before your registration expires

Updating your details

You must keep your registration details current. Notify the Commission if any of the following change:

• Business name or trading names
• Registered address
• Contact person for data protection
• Nature of processing activities
• Staff numbers or turnover that affect your tier

Log in to your Commission account to make updates at any time.

What happens if you do not pay

Failure to pay the data protection fee is enforced through civil enforcement and monetary penalties. The Commission actively enforces the fee requirements.

If you fail to pay the data protection fee when required:

• the Commission can serve a penalty notice of up to £4,350, the maximum fixed penalty in its published penalty policy for non-payment under the Data Protection Act 2018
• you must still pay the fee owed on top of the penalty
• you can appeal a penalty notice to the Information Tribunal

If the Commission identifies that you should be registered, they issue a notice giving you 28 days to pay or make representations. Do not ignore this notice.

Do not let your registration lapse. If the fee remains unpaid, the Commission can take civil enforcement action even if you were previously registered.