It’s something that’s easily overlooked, particularly by sole traders and small businesses, but most businesses that handle personal information will need to pay an annual data protection fee to the ICO, unless a specific exemption applies.
And before you assume this doesn’t apply to you because you’re only a small business, it’s worth taking a closer look.
What is the ICO?
The Information Commissioner’s Office (ICO) is the UK’s independent regulator responsible for upholding information rights and data protection legislation.
In simple terms, it helps ensure that organisations handle people’s personal information properly, keep it secure and use it appropriately.
If your business collects, stores or uses information about individuals, you’re likely to have responsibilities under data protection legislation.
What counts as personal information?
You might be surprised how much personal information your business holds in the ordinary course of a working day.
For example:
- Customer names, addresses, email addresses and telephone numbers.
- Supplier contact details.
- Employee records, including payroll and bank details.
- Job applications and CVs.
- Customer payment information.
- Mailing lists and marketing contact details.
- CCTV footage identifying individuals.
It doesn’t matter whether you’re a limited company, sole trader, partnership or small organisation. If you’re using personal information for business purposes, data protection rules are likely to apply.
Do I need to register with the ICO?
This is where you need to do a little checking.
Organisations that process personal data as a data controller generally need to pay an annual data protection fee to the ICO, unless they qualify for an exemption.
There are some exemptions, including certain organisations that process personal information only for specific purposes such as staff administration, accounts and records, or advertising and marketing.
However, exemptions are narrower than many people realise. If you use personal information for additional purposes, you may no longer qualify.
For example, simply having employee or customer information doesn’t automatically mean you must pay the fee, but the way you use and process that information matters.
The ICO has a handy online self-assessment tool that will help you work out whether you need to pay.
Our advice? Don’t guess. Spend ten minutes checking.
How much does ICO registration cost?
The good news is that for most small businesses, the annual fee is relatively modest.
The current fee structure has three tiers:
| Organisation size | Annual fee |
|---|---|
| Tier 1: Micro organisations | £52 |
| Tier 2: Small and medium organisations | £78 |
| Tier 3: Large organisations | £3,763 |
The tier depends on factors including staff numbers and annual turnover.
You can also receive a £5 discount by paying by direct debit.
For many small businesses, this is just £52 a year, or £47 if paying by direct debit.
What happens if I don’t register?
If you are required to pay the data protection fee and fail to do so, the ICO can take enforcement action.
The maximum penalty for failing to pay the required fee is currently £4,350.
The ICO also maintains a public register of fee payers, so registering demonstrates that you’ve taken this particular data protection responsibility seriously.
It’s a relatively small cost compared with the potential consequences of ignoring it.
How do I register?
The process is straightforward and can be completed online.
- Visit the ICO website.
- Complete the data protection fee self-assessment to establish whether you need to pay.
- If you are required to register, complete the online application.
- Pay the appropriate annual fee.
- Make a note of your renewal date so you don’t forget next year.
The ICO estimates that the self-assessment takes around ten minutes.
If you’ve received a letter from the ICO, don’t ignore it. Check whether you need to pay or whether you qualify for an exemption.
Is registering with the ICO all I need to do?
No, and this is an important distinction.
Paying the ICO data protection fee does not automatically make your business GDPR compliant.
You still need to make sure you’re handling personal information responsibly. This includes:
- Having an appropriate privacy notice.
- Keeping personal information secure.
- Only collecting information you actually need.
- Making sure you have a lawful reason for using personal data.
- Not keeping information for longer than necessary.
- Knowing what to do if there’s a data breach.
- Understanding people’s rights over their personal information.
The ICO has a useful collection of free guides, templates and checklists specifically designed for small businesses.
Our recommendation
We regularly come across small business owners who are doing a fantastic job of running their businesses but have overlooked some of the less obvious compliance requirements.
ICO registration is one of those things that can easily slip through the net.
So, take ten minutes today and check whether you need to register. If you do, get it sorted and add the renewal to your annual compliance calendar.
It’s one less thing to worry about!
Useful links:
- ICO website
- ICO advice for small organisations
- Check whether you need to pay the ICO fee
- Register and pay the data protection fee
If you’re unsure whether your business needs to register, use the ICO’s own guidance and self-assessment rather than assuming you’re exempt.
