Is this ICO data protection fee letter genuine — and what happens if you haven't paid?

It is probably genuine. The data protection fee is a legal requirement, and the amounts are fixed by law at £52, £78 or £3,763 a year — so any demand for a different sum is a third party's service charge or a scam. If you have not paid, the ICO must warn you before it can fine you, and the standard fixed penalty is £400, £600 or £4,000 depending on your tier.

Last updated 31 July 2026. This page explains the law as it stands on that date. It is general information, not legal advice.

The fee is genuine — and these are the only amounts it can be

Under regulation 2 of the Data Protection (Charges and Information) Regulations 2018, a controller must pay an annual charge to the Information Commissioner unless every part of its processing is exempt processing. Sole traders are caught as well as companies. So a letter telling you that you may owe a fee is not, by itself, evidence of a scam.

Those amounts come from regulation 3. They last changed on 17 February 2025, when they rose from £40, £60 and £2,900. They have not changed since, and there is no 2026 increase. Charities that are not otherwise exempt, and small occupational pension schemes, pay the tier 1 fee whatever their size.

How to check a letter, email or cold call in five minutes

1. Step 1 Do not use the link or the phone number in the letter Type ico.org.uk into your browser yourself, or search for "ICO fee" and go to ico.org.uk from the results. The ICO's own guidance is that genuine correspondence will always direct you to its official website.
2. Step 2 Compare the amount to the three tiers If the sum is not £52, £78 or £3,763 — or £47, £73 or £3,758 by direct debit — it is not the statutory fee on its own.
3. Step 3 Search online for whoever sent it This is the ICO's own advice: if you want to check that correspondence is genuine, "it is a good idea to search online for the organisation who sent it, or talk to someone you trust such as a friend or family member". A trading name that is not the ICO is the clearest tell of all.
4. Step 4 Search the public register The register of fee payers is searchable at ico.org.uk/ESDWebPages/Search. If you are already listed and in date, a demand for immediate payment is wrong.
5. Step 5 Ring the fees helpline yourself 0303 123 1113, Monday to Friday, 9am to 5pm excluding bank holidays. Use the number published on ico.org.uk, not the one printed on the letter.
6. Step 6 Report anything fake The ICO points people to gov.uk and to fraud reporting services for advice. Reporting a fake does not affect any genuine fee you owe.

How did the ICO know about your business?

Two ordinary things put you on the list. First, the ICO works from publicly available company data — it notes that some company data has to be made public by law, such as the data published at gov.uk. In November 2019 it launched a campaign to contact all registered companies in the UK, which it called the start of an extensive programme to make sure the fee is paid by everyone who needs to pay it, and it says it regularly promotes the need to pay. Second, the register of fee payers is itself public and represents more than a million companies, which is the sort of list commercial mailers work from.

So a letter does not mean the ICO has investigated you or thinks you have done something wrong. Usually it means your company exists at Companies House and your name is not on the register.

"Compliance agencies" and agents: you do not need one

The ICO's position is blunt. It says some private companies offer to complete the payment for you, "often charging more than the standard cost", and warns that "these agencies have no official standing or powers under data protection law, and there is no connection between them and the ICO - we recommend you pay the ICO directly".

Registering directly takes about 15 minutes, on the ICO's own estimate. You need your organisation's details, a contact, and the tier you think applies. There is no approval scheme for ICO registration agents, because there is nothing to approve.

If you have already paid a third party

• Search the register first. If the agent did register you, you are listed and the fee is paid. You have overpaid for something you could have done yourself, but you are not in breach.
• If you are not listed, you have paid an agent and you still owe the ICO. Register directly and treat the two as separate problems.
• Money paid to a private company is a matter between you and that company. The ICO has no power to refund it. If you paid by card, ask your card provider what recovery options apply to you.
• Check for a recurring payment or rolling "annual compliance" subscription you did not mean to set up.

The ICO says you should have registered — what happens now

The ICO cannot go straight to a fine. The statutory sequence is set out in Schedule 16 to the Data Protection Act 2018.

1. Step 1 Reminder correspondence The ICO writes asking you to pay or to tell it you are exempt, with a date by which it expects to hear from you. Responding at this stage normally ends it.
2. Step 2 Notice of intent Before any penalty, the Commissioner must give a written notice of intent (paragraph 2) and allow at least 21 days for written representations (paragraph 3(4)). Since 5 February 2026, paragraph 4 has required the Commissioner then either to give a penalty notice or to give written notice that no penalty will be imposed, within six months of the notice of intent or as soon as reasonably practicable after.
3. Step 3 Penalty notice If a penalty is imposed, the notice must give you at least 28 days to pay (paragraph 6(2)).
4. Step 4 Appeal Section 162(1)(d) of the Act gives a right of appeal to the Tribunal against the notice, and section 162(3) a separate right to appeal the amount.

The ICO publishes every penalty notice it issues for non-payment, by year. As at 31 July 2026 the 2026 list showed six organisations, the most recent dated 31 March 2026, and the 2025 list showed one. Those lists understate the total — the ICO leaves out personally identifiable sole traders and partnerships, and any penalty subject to an ongoing appeal — but they show that fines are real and are published by name.

The penalty: £400, £600 or £4,000 — and where £4,350 comes from

Those are the figures in the document the Commissioner publishes under section 158 of the Data Protection Act 2018. The same document says the ICO reserves the right to increase the amount "up to a statutory maximum of £4,350" for controllers who fail to give it enough information to determine the appropriate fee or exemption, depending on aggravating factors such as a failure to engage or co-operate.

That is the whole story behind the £4,350 you will see quoted elsewhere: it is a ceiling for that aggravated case, not the standard fine. It is also worth knowing where it came from. Section 158(3) caps the penalty at 150% of the highest charge payable, ignoring the direct debit discount — and £4,350 is exactly 150% of £2,900, the tier 3 fee before February 2025. On today's £3,763 fee, that statutory ceiling would be £5,644.50. As at 31 July 2026 the ICO's published document still states £4,350, so check the current version before relying on any figure.

In every case the penalty sits on top of the fee. Paying a fine does not register you.

Are you in the right tier — or exempt altogether?

If a letter quotes £3,763 and you are a two-person business, that is almost certainly a default rather than an assessment. The ICO states plainly: "We regard all controllers as eligible to pay a fee in tier 3 unless and until they tell us otherwise." Tell it your staff numbers and turnover and the tier changes.

"Members of staff" is defined broadly — employees, workers, office holders and partners — counted as a monthly average across your financial year, with each part-timer counted as one, wherever in the world they are based. Public authorities tier on staff numbers only and ignore turnover.

You do not have to pay at all if every purpose you process personal data for falls inside one of these:

• Staff administration
• Advertising, marketing and public relations
• Accounts and records
• Not-for-profit purposes
• Personal, family or household affairs
• Maintaining a public register
• Judicial functions
• Processing personal information without an automated system such as a computer
• Members of the House of Lords, elected representatives and prospective representatives (since 1 April 2019)

The catch is the word "every". The ICO's position is that using CCTV for crime prevention always requires a fee whatever else you do, and that if you use a dashcam on a work vehicle for work purposes you are likely to need to register and pay unless you are exempt. If you are sure you are exempt, the ICO has an exemptions form so it stops writing to you. It asks you to keep a record of why you think you do not have to pay, and warns that its system does not issue a confirmation of receipt automatically. Being exempt from the fee does not exempt you from the rest of data protection law.

Common questions

Sources

This page summarises the following primary sources. Where they disagree with this summary, they take precedence.

• The Data Protection (Charges and Information) Regulations 2018, reg. 3 — current fee amounts (legislation.gov.uk)
• The Data Protection (Charges and Information) Regulations 2018, reg. 2 — duty to pay the charge (legislation.gov.uk)
• Data Protection Act 2018, s.158 — fixed penalties for failure to pay charges (legislation.gov.uk)
• Data Protection Act 2018, Schedule 16 — notice of intent and penalty notice procedure (legislation.gov.uk)
• ICO — Fixed penalties for failure to pay the data protection charge
• ICO — Registration FAQs (scam warning, agencies, fines, helpline)
• ICO — Guide to the data protection fee (tiers, staff counting, tier 3 default)
• ICO — Penalty notices issued for non-payment of data protection fee
• GOV.UK — Pay the data protection fee