If your UK business handles personal data, you are likely legally required to register with the Information Commissioner’s Office (ICO) and pay an annual data protection fee.
This guide breaks down exactly what you need to know for 2026: from the exact fee tiers and exemption criteria, to the legal definition of ‘data processing’ and the upcoming regulatory changes you need to prepare for.
Understanding the Basics: Processing and Roles
Before looking at the costs, it helps to understand how the ICO defines your data activities.
What Does “Processing” Actually Mean?
Many business owners assume they don’t process data because they aren’t a tech company. However, under UK data protection law, “processing” is a very broad term. If you handle personal information electronically, you are processing data. This includes:
Collecting or recording information.
Organising, structuring, or storing data.
Retrieving, consulting, or using information.
Altering, disclosing, or erasing data.
If you save a client’s phone number on a work mobile, keep employee payroll details on a laptop, or back up an email list to the cloud, you are processing personal data.
Controllers vs. Processors
The legal obligation to pay the ICO fee falls specifically on the Data Controller.
A Controller is the person or business that decides how and why personal data is processed. If you choose to collect customer emails to send a newsletter, you are a controller and must pay the fee.
A Processor simply handles data on behalf of another organisation, following their strict instructions without making independent decisions. Processors are generally exempt from the fee.
However, because almost every business controls some data, such as the HR records of its own employees, it is very rare to operate purely as a processor.
Financials & Administration: Fees, Deadlines, and Penalties
The data protection fee is set by Parliament and funds the ICO’s regulatory work. The amount you owe is tiered based on the size and turnover of your business.
The 2026 Fee Tiers
Tier 1: £52 per year (or £47 if paid via Direct Debit). This applies to micro-organisations with no more than 10 members of staff, OR a maximum turnover of £632,000.
Tier 2: £78 per year (or £73 if paid via Direct Debit). This applies to small and medium organisations with no more than 250 members of staff, OR a maximum turnover of £36 million.
Tier 3: £3,763 per year (or £3,758 if paid via Direct Debit). This applies to large organisations that exceed the limits of Tiers 1 and 2.
Deadlines and Reminders
There is no fixed, universal calendar deadline for paying the ICO fee. Instead, you are legally required to register and pay the fee as soon as your business starts processing personal data.
Once registered, the fee must be renewed annually. The ICO actively monitors the Companies House register and routinely sends reminder letters to a company’s registered office address if they suspect the business is trading but hasn’t registered.
Penalties for Non-Compliance
Ignoring ICO reminder letters or failing to pay the correct fee is a breach of data protection law. The consequences include:
Financial Penalties: The ICO can issue fines ranging from £400 to £4,000 for non-payment.
Public Shaming: The ICO publishes a list of penalty notices. Customers and partners increasingly check the public register of fee payers, and being absent from it can severely damage your commercial reputation.
Exemptions: Do You Really Have to Pay?
Not every business must pay the fee. If you only process data manually (using paper records with no computers or electronic devices), you are exempt.
For businesses using electronic systems, you are only exempt if you process personal information exclusively for one or more of the following core administrative purposes:
Staff administration (e.g., running payroll).
Advertising, marketing, and public relations (strictly for your own business).
Accounts and records (e.g., tracking client invoices).
Not-for-profit purposes.
Personal, family, or household affairs.
Maintaining a public register.
Judicial functions.
The CCTV Trap: It is incredibly easy to accidentally void an exemption. For example, if you claim the “accounts and records” exemption, but you install a CCTV camera or dashcam for crime prevention, your exemption is immediately voided and you must pay the fee.
If you are unsure where your business stands, we strongly recommend taking the ICO’s free online self-assessment before making an assumption.
Future-Proofing: The June 2026 Complaints Duty
Beyond the annual fee, businesses must also prepare for upcoming regulatory changes under the Data (Use and Access) Act 2025.
By 19 June 2026, it will become a mandatory statutory requirement for organisations to have a formal process in place to handle data protection complaints. This means you will need an accessible way for individuals to submit a complaint directly to you, and you must acknowledge receipt of that complaint within 30 days. Getting your baseline ICO registration sorted now ensures you have a solid compliance foundation before these new rules take effect.
How FormationsHunt Can Help
Understanding your data controller status, navigating self-assessments, and tracking annual renewal dates is a distraction from running your business.
£52.00 goes directly to the ICO to cover your mandatory Tier 1 fee.
£47.99 is our service fee.
For £47.99, our compliance experts will assess your business to confirm your tier, check for valid exemptions, manage the entire application process, and secure your official ICO Registration Number and digital Certificate.
We ensure you are promptly listed on the public register of fee payers, protecting your business from £4,000 fines while you focus on what matters most: growing your company.
We love talking to you when it comes to creating something new. We want you to remember us always, let’s be good for good and for a good reason. Reach us through your voice or writing.
Client Login
