Quick answer: Most small organisations that keep personal information on a computer must pay the ICO data protection fee every 12 months. For a micro organisation with up to 10 staff or turnover up to £632,000 it is £52, or £47 by direct debit. Charities that are not exempt pay tier 1 too. The ICO’s self-assessment confirms if you are exempt.
“Do I need to register with the ICO?” is one of the first data protection questions a new practice manager, care home owner or charity trustee asks. Since 2018 the answer has been about the data protection fee: paying it is what most people still call registering with the Information Commissioner’s Office (ICO). This guide explains who pays, how much, who is exempt and what to do next. Every figure below was checked on the ICO’s own pages on 17 October 2026.
Who has to pay the ICO data protection fee?
Every organisation or sole trader that decides how personal information is used (a “controller”) must pay the fee, unless all of its processing falls within one of the exemptions. The ICO’s data protection fee page says that not all controllers must pay a fee and that many can rely on an exemption. The catch is that the exemptions are narrow.
For the organisations we work with, the usual picture is:
- Dental practices keep patient records, appointment systems and recall lists on computer, so they will almost always need to pay.
- Care homes and home care providers keep care plans, resident or client details and staff records, so they will almost always need to pay.
- Small charities that keep supporter, client or volunteer details on a computer usually need to pay, at the tier 1 rate.
How much is the ICO fee in 2026?
The fee is £52, £78 or £3,763 a year, depending on which tier you are in. The tiers are set by Parliament and depend on staff numbers or turnover:
| Tier | Who it covers | Fee | By direct debit |
|---|---|---|---|
| Tier 1 (micro) | Turnover up to £632,000, or no more than 10 members of staff | £52 | £47 |
| Tier 2 (small and medium) | Turnover up to £36 million, or no more than 250 members of staff | £78 | £73 |
| Tier 3 (large) | Everyone who does not meet tier 1 or tier 2 | £3,763 | £3,758 |
Three details catch people out:
- Counting staff. The ICO counts the average number of staff working for you during your financial year, and each part-time member of staff counts as one.
- Charities pay tier 1. A charity that is not otherwise exempt only pays the tier 1 fee, whatever its size.
- Tier 3 is the default. The ICO treats every controller as tier 3 unless and until you tell it otherwise, so check your tier is right when you pay.
Which organisations are exempt from the fee?
You are exempt only if you process personal information only for one or more of the purposes the ICO lists on its exemptions page:
- staff administration
- advertising, marketing and public relations for your own organisation
- accounts and records
- not-for-profit purposes
- personal, family or household affairs
- maintaining a public register
- judicial functions
- processing personal information without an automated system such as a computer
The word “only” does the work. A dental practice whose payroll would be exempt still pays, because it also keeps patient records. A small charity may qualify under not-for-profit purposes, but the conditions are narrow, so run the ICO’s self-assessment rather than assume. Even if you are exempt, the ICO is clear that you still have to meet your other data protection obligations.
What happens if you do not pay?
The ICO can fine you. Its fee FAQs say a controller that should pay but does not may be fined up to £4,350. In practice, the bigger risk for a small organisation is the questions that follow: a missing fee is often the first sign that other basics, such as a privacy notice or a breach log, are missing too.
How do you pay or renew the fee?
- Run the self-assessment on the ICO website to confirm you need to pay.
- Gather the details: your legal name, address, turnover or staff numbers, and a named contact.
- Pick your tier carefully, using the average staff count for your financial year.
- Pay by direct debit to save £5 on every payment.
- Keep the reference with your other data protection records, such as your DSPT evidence if you complete the toolkit, and diarise the renewal date.
What else does UK GDPR expect of a small organisation?
Paying the fee is the start, not the finish. You also need to know what personal information you hold and why, keep it secure, answer requests from the people it is about and handle breaches properly. Our guides to handling a subject access request and PECR for small organisations cover two of the most common next questions. If you work with NHS data, completing the DSPT step by step walks through the toolkit.
FAQs
Does a small charity have to pay the ICO fee?
Usually, yes, unless it is exempt. The ICO says charities that are not otherwise exempt only pay the tier 1 fee, which is £52, or £47 by direct debit. A charity that keeps a supporter or client database on a computer is unlikely to fall within the exemptions.
How often do we pay the data protection fee?
Every 12 months. Put the renewal date in your own diary as well, especially if the person who paid last year has since left.
Does paying the fee mean we comply with UK GDPR?
No. The fee is a separate legal duty. You still need to keep personal information secure, answer subject access requests, report serious breaches and follow the other data protection rules.
Is it cheaper to pay by direct debit?
Yes. The ICO takes £5 off automatically when you pay by direct debit, so the tier 1 fee becomes £47 and the tier 2 fee £73.
How we can help
Unavoidably Secure reviews your controls, website and email security and gives you a plain-English list of what to fix first, written for small teams. We do not certify, accredit or guarantee compliance, and we cannot pay the ICO fee or make the exemption decision for you: that is your organisation’s responsibility.
This guide is general information, not legal advice. Facts were checked against the ICO’s data protection fee, exemptions and FAQ pages on 17 October 2026. For more practical guides, browse the blog.
Not sure where you stand on data protection?
Book a free external audit. We will review your website, email security and the basics regulators look for, and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.