UK Statutory Instrument SI 2018 United Kingdom

Data Protection (Charges and Information) Regulations 2018

These Regulations set out the circumstances in which data controllers are required to pay a charge, and provide information, to the Information Commissioner from 25th May 2018. They will replace the previous regime under the Data Protection (Notification and Notification Fees) Regulations 2000 (S.I. 2000/188).

Read it on legislation.gov.uk (opens in a new tab)
Enforced by
ICO
Status
In Force
Penalty ceiling
Prosecution 1 of 2 obligations carry a fine up to £17,500,000. 1 has no criminal penalty — flagged in the list below.

Does it bind you?

Business-side roles with duties under this instrument.

Data Controller1 Trader1

Other Acts binding the same actors

If a role above is yours, these are the other instruments that most often bind it.

Data Controller — also bound by 35 other Acts
Trader — also bound by 825 other Acts
Companies Act 2006 243 duties
Companies Act 1985 85 duties

What it requires

Regulations creating concrete business duties or carrying penalties, grouped as the instrument is structured. Titles link to the source text — blue means you’re leaving for legislation.gov.uk.

s.004 Requirements in respect of partnerships (opens in a new tab) Regulated
  • Register your business partnership for data protection as a single firmTrader
s.005 Requirements in respect of the governing body of, and head teacher at, any school (opens in a new tab) Prosecution
  • Register schools as a single data controller with the ICOData Controller

Fine up to £17,500,000

5 other provisions — procedural and definitional
s.001 Citation, commencement and interpretation (opens in a new tab)
s.002 Requirements on data controllers (opens in a new tab)
s.003 Amount of charge payable under regulation 2 (opens in a new tab)
s.006 Crown application (opens in a new tab)
s.exempt processing EXEMPT PROCESSING

Help complying

Guvnor’s practical routes through this instrument.

Marketing compliance: PECR and UK GDPR

Learn how to send compliant marketing emails, texts, and make telephone calls. Covers PECR consent rules, the soft opt-in exception, TPS screening, …

Respond to a data breach

Step-by-step breach response when personal data has been compromised. Covers the 72-hour ICO notification deadline, assessing risk, notifying affected individuals, and documenting …

Understanding UK GDPR from scratch

A complete introduction to UK data protection law for businesses. Learn the seven principles, six lawful bases, individual rights, ICO registration requirements, …

Handle a data subject access request

Respond correctly to a data subject access request within the one-month deadline. Covers identity verification, data searches, exemptions, extensions, and record-keeping.

Prepare for the Data Use and Access Act 2025 changes

A step-by-step guide to understanding and adapting to the Data (Use and Access) Act 2025. Covers the 8 key reforms now in …

Respond to an ICO investigation

What to do when the Information Commissioner's Office contacts you about an investigation, complaint, or audit. Understand the types of ICO action, …
6 more guides that reference this instrument
Data protection annual compliance checklist Data protection for businesses Register with the ICO and pay the data protection fee Cryptoasset Business Regulation Data protection for retail businesses Retail sector market overview

Duty extraction and severity labels are Guvnor’s analysis of the instrument, not the instrument itself. Always verify against the linked source text.