Most businesses that hold customer or staff details on a computer or phone need to pay. For most small businesses it's £52 a year, or £47 by direct debit. Not paying can lead to a penalty of up to £4,350.
Who has to pay
If your business processes personal information, such as customer contact details, bookings or staff records, on a computer, phone or online service, you probably need to pay the data protection fee to the ICO every year. Sole traders count as businesses too.
How much it costs
| Tier | Who | Fee | By direct debit |
|---|---|---|---|
| Tier 1: micro | Up to 10 staff, or annual turnover up to £632,000 | £52 | £47 |
| Tier 2: small and medium | Up to 250 staff, or annual turnover up to £36 million | £78 | £73 |
| Tier 3: large | Everyone else | £3,763 | £3,758 |
Charities and small occupational pension schemes pay the tier 1 fee whatever their size. If you don't tell the ICO which tier you're in, you may be charged the tier 3 fee.
Exemptions
You don't have to pay if you only use personal information for:
- staff administration,
- advertising, marketing and public relations for your own business,
- accounts and records,
- not-for-profit purposes,
- personal, family or household affairs,
- maintaining a public register, or judicial functions,
- or if you don't process personal information on a computer at all.
The exemptions are narrow. If you do anything beyond them, such as using CCTV for security, or holding customer records to provide your service, you'll usually need to pay. The ICO has a short self-assessment on its website if you're unsure.
What happens if you don't pay
The ICO can issue a penalty of up to £4,350. It also publishes a register of fee payers, which customers and buyers sometimes check, and many tenders and supplier forms ask for your registration number.
The ICO's new name
On 30 September 2026 the Information Commissioner's Office became the Information Commission. It still uses the name ICO, and existing registrations carry on. If your privacy notice simply says "ICO", there's no need to change it.
What else UK GDPR expects
Paying the fee is only one part. Small businesses also need a privacy notice, a way to handle data breaches and requests, records of what data they hold, and, since 19 June 2026, a process for handling data protection complaints. The compliance pack in our readiness report includes all of these, written for your business.
Common questions
How much is the ICO fee for a small business?
Most small businesses are in tier 1 and pay £52 a year, or £47 by direct debit. Businesses with more than 10 staff and turnover over £632,000 pay £78.
What's the penalty for not paying the ICO fee?
The ICO can issue a penalty of up to £4,350.
Has the ICO changed its name?
Yes. On 30 September 2026 it became the Information Commission, but it still uses the name ICO.
Sources
- ICO: Data protection fee
- Bar Council: Data protection fees payable to the ICO (July 2026)
- VinciWorks: The ICO becomes the Information Commission
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.