Do I need to register with the ICO, and how much is the data protection fee in 2026?

Most UK organisations that use personal information — including sole traders and one-person limited companies — must register with the ICO and pay an annual data protection fee. That fee is £52, £78 or £3,763 depending on your size, and it has not changed in 2026.

Last updated 31 July 2026. This page explains the law as it stands on that date. It is general information, not legal advice.

The bottom line

The data protection fee has not changed in 2026. It is still £52 (tier 1), £78 (tier 2) or £3,763 (tier 3), each reduced by £5 if you pay by direct debit. Those amounts have applied since 17 February 2025. If you process personal data as a controller and any part of what you do falls outside the exempt purposes, you have to pay.

Has the fee changed in 2026?

No. The fee today is exactly what it was throughout 2025. The current amounts were substituted into regulation 3(1) of the Data Protection (Charges and Information) Regulations 2018 by the Data Protection (Charges and Information) (Amendment) Regulations 2025, which came into force on 17 February 2025.

Tier	Fee before 17 Feb 2025	Fee now (unchanged in 2026)	With direct debit
Tier 1 — micro	£40	£52	£47
Tier 2 — small and medium	£60	£78	£73
Tier 3 — large	£2,900	£3,763	£3,758

If a page still quotes £40, £60 and £2,900, it is out of date. Those were the original 2018 figures, replaced after a government consultation that settled on a 29.8% uplift across all tiers. Nothing further has been laid since. The only pending amendment to the 2018 Regulations is a set of terminology changes made by the Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (SI 2026/386), which substitute references to the Information Commissioner with the Information Commission in regulation 2(2) and 2(3). Those changes are recorded on legislation.gov.uk as not yet applied — they take effect only when section 119 of the Data (Use and Access) Act 2025, transferring functions to the Information Commission, is fully in force — and they do not touch the money.

Who has to register and pay?

Regulation 2(1) puts it simply: a data controller must comply with the requirements of that regulation — paying the charge and supplying the specified information — "unless all of the processing of personal data they undertake is exempt processing". Note the word *all*. A single non-exempt activity makes the fee payable.

The exempt purposes are set out in the Schedule to the Regulations. The ICO summarises them as processing only for:

staff administration
advertising, marketing and public relations for your own business, goods or services
accounts and records
not-for-profit purposes
personal, family or household affairs
maintaining a public register
judicial functions
processing without an automated system — in other words, paper records only

Since 1 April 2019, members of the House of Lords, elected representatives and prospective representatives are also exempt. More than one million controllers currently sit on the ICO's register of fee payers. Awareness is patchier than that suggests: DSIT's UK Business Data Survey 2026, published on 18 June 2026, found that 21% of businesses handling digitised data said they had not heard of the ICO, and that 56% of micro businesses said they had heard of it and knew what it was, against 73% of large businesses.

There is no small-business exemption from the law itself

The exemptions above are exemptions from *paying the fee*, not from the UK GDPR. If you handle personal data as a controller or processor you must still comply with the law — lawful basis, transparency, security, individual rights — however small you are and whether or not you pay a penny to the ICO.

Sole traders, freelancers and one-person limited companies

There is no exemption for being small, and none for being a sole trader. The ICO's registration service covers all data controllers, sole traders and companies alike. But size is not the test — what you do with personal data is. Some one-person businesses genuinely do fall within the exempt purposes: a freelance consultant whose only personal data is a marketing list for their own services plus accounting records for clients may not need to pay. Adding almost anything else — CCTV, detailed client case files, health or financial records held for someone else's benefit, staff monitoring beyond basic administration, or processing on another organisation's behalf — usually takes you outside them. Because the exemption only works if *every* activity is covered, work it through on the ICO's self-assessment rather than assuming.

CCTV, dashcams and doorbell cameras

This is a common reason a business that thought it was exempt turns out not to be. The ICO's position is blunt: any company using CCTV for crime prevention purposes is required to pay the annual fee, regardless of other aspects of the business. The ICO adds that you do not even need to take the self-assessment in that case, because the answer will always be yes.

CCTV or similar technology at your premises — if it could capture images of people and you are not already registered, the ICO says you must register and pay. For SMEs that is £52 or £78 a year, or £47 or £73 by direct debit.
Dashcams and in-vehicle cameras used for work — the ICO says using a dashcam in or on your vehicle for work purposes is not 'domestic', so the household exemption does not apply. The duty sits with the business, not the individual driver, and the ICO's guidance also covers a camera installed in an employee's personal vehicle used for your business journeys.
Doorbell cameras — a camera on your own front door used purely for household purposes falls within the personal, family or household exemption, so no fee is due. The same device covering business premises, or used for the purposes of a business you run, is CCTV like any other.

When you complete the ICO self-assessment, a dashcam on a work vehicle should be declared by answering 'Yes' to the question about operating CCTV.

Which tier am I in, and how do I count staff and turnover?

Tier	Test in regulation 3(2)	Fee	With direct debit
Tier 1 — micro	Turnover no more than £632,000 for your financial year or no more than 10 members of staff	£52	£47
Tier 2 — small and medium	Not in tier 1, and turnover no more than £36 million or no more than 250 members of staff	£78	£73
Tier 3 — large	Everyone else	£3,763	£3,758

The word 'or' matters: you only need to satisfy one limb. A 12-person consultancy turning over £400,000 is in tier 1 on turnover, even though it has more than 10 staff. The default is tier 3 — the ICO regards all controllers as eligible to pay in tier 3 "unless and until they tell us otherwise". Turnover and staff numbers are assessed as at the first day of the charge period, under regulation 3(4).

Counting members of staff

'Members of staff' is defined broadly in regulation 1(2) to include employees, workers, office holders and partners. To get the number:

for each completed month of your financial year, total the number of members of staff that month
add the monthly totals together
divide by the number of months in your financial year
count each part-timer as one — there is no full-time-equivalent adjustment
include staff wherever in the world they are based

Charities, pension schemes and public authorities

Charities not otherwise exempt pay the tier 1 fee of £52, regardless of size or turnover. Regulation 3(6) defines 'charity' by reference to the charity legislation of England and Wales, Scotland and Northern Ireland.
Small occupational pension schemes not otherwise exempt likewise pay tier 1.
Public authorities tier themselves on staff numbers only — regulation 3(3) disapplies the turnover limbs for them.

How to register, and how to get the £5 discount

Step 1 Check whether you need to pay Use the ICO's fee self-assessment at ico.org.uk/fee-checker. It takes about 10 minutes and tells you both whether you must pay and how much.
Step 2 Gather your details Organisation name and address, contact details, your number of members of staff, your turnover and a payment method. You have to complete the form in one session.
Step 3 Complete the online application The ICO says a new registration takes about 15 minutes. The fees helpline is 0303 123 1113 if you get stuck.
Step 4 Pay by direct debit to save £5 The £5 reduction in regulation 3(5) is applied automatically at the point of payment. Direct debit also rolls the payment over each year, so the registration does not lapse by accident. Card, BACS and cheque are also accepted.
Step 5 Wait for confirmation The ICO says it usually sends confirmation the following working day and publishes the entry on the register of fee payers within seven working days. New registrations and certificates take two working days to become available to download.

Be wary of third-party agencies offering to register you. The ICO warns that these firms have no official standing or powers under data protection law, have no connection with the ICO, often charge more than the standard cost, and recommends you pay the ICO directly at ico.org.uk.

Renewing, changing tier and cancelling

The fee runs in 12-month charge periods, defined in regulation 2(6), and regulation 2(2) requires payment within the first 21 days of each one. The ICO writes to organisations about the fee, but the legal duty is yours: if the registration expires you stop appearing as a current fee payer on the public register. To change your tier, address, trading names or DPO details, use the ICO's online change service — you will need your registration reference, beginning Z, A or C, and your security number. Changing the organisation's legal name has to be done by phone on 0303 123 1113.

Cancelling does not stop your direct debit

The ICO says plainly that cancelling your registration will not automatically stop your direct debit. If you pay that way you must also cancel the instruction with your bank or building society, or you will keep paying for a registration you have already cancelled. Cancelling takes about 10 minutes online and needs your registration reference.

If you should have paid and did not, the ICO can serve a penalty notice under section 155(1) of the Data Protection Act 2018. Section 158 requires the Commissioner to publish a document specifying the amount of that fixed penalty, and section 158(3) caps it at 150% of the highest charge payable, disregarding the direct debit discount. The published document sets the fixed penalty at £400 for tier 1, £600 for tier 2 and £4,000 for tier 3, and reserves the right to increase it up to a maximum of £4,350 where there are aggravating factors such as a failure to engage or co-operate with the ICO. The "£400 to £4,000" range in the ICO's registration FAQs is that same scale, not a competing figure. One oddity to note: the document already quotes the current £52 to £3,763 fees, but £4,350 is 150% of the old £2,900 top tier, so the ceiling has not been recalculated on the higher fee.

Check whether you need to pay: ICO fee self-assessment open_in_new

Common questions

Do I need to register with the ICO if I'm a sole trader?

Possibly. There is no exemption for sole traders as such — the ICO's registration service expressly covers them. Whether you pay depends on what you do with personal data. If every activity falls within the exempt purposes (staff administration, accounts and records, marketing your own services, not-for-profit purposes, purely paper records and so on) you do not pay. If any activity falls outside them, you do. Use the ICO's self-assessment at ico.org.uk/fee-checker to check.

Is the ICO fee still £40?

No. £40, £60 and £2,900 were the original 2018 amounts. They were replaced on 17 February 2025 by SI 2025/63 with £52, £78 and £3,763. Those are still the amounts today — there has been no further change in 2026.

Do I have to pay the ICO fee if I only have CCTV at my shop?

Yes. The ICO says any company using CCTV for crime prevention purposes is required to pay the annual fee regardless of other aspects of the business, and that you do not even need to take the self-assessment because the answer will always be yes. For most SMEs that means £52 or £78 a year.

How much is the ICO fee for a small limited company in 2026?

Almost always £52, or £47 by direct debit. A company qualifies for tier 1 if its turnover is no more than £632,000 for the financial year or it has no more than 10 members of staff — you only need to meet one of the two.

What happens if I don't pay the ICO data protection fee?

You are breaking the law and the ICO can serve a penalty notice. Its published fixed penalties are £400 for tier 1, £600 for tier 2 and £4,000 for tier 3, and the ICO reserves the right to go up to £4,350 where there are aggravating factors such as failing to engage with it. Section 158(3) of the Data Protection Act 2018 caps any such penalty at 150% of the highest charge payable, ignoring the direct debit discount.

I've cancelled my ICO registration — why is money still leaving my account?

Because cancelling the registration does not cancel the direct debit. The ICO states this explicitly on its cancellation page. You have to cancel the direct debit instruction separately with your bank or building society.

Sources

This page summarises the following primary sources. Where they disagree with this summary, they take precedence.