ICO registration fee: who has to pay, how much, and what changes on 30 September

The short version

• Most businesses that hold personal data on a computer must pay. The only way out is if "all of the processing of personal data they undertake is exempt processing".
• For a small business it is £52 a year, £47 by direct debit. Medium businesses pay £78 and large ones £3,763.
• The exemptions are real. Staff records, your own marketing and your own accounts and customer records are all on the list. One purpose that is not, and you pay.
• Pay within 21 days of the start of each 12-month period.
• From 30 September 2026 the fee goes to the Information Commission. The Information Commissioner’s office is abolished that day. You do not need to do anything: what was already done carries over.
• Not paying can cost you a fixed penalty, which the law caps at 150% of the top-tier fee.

What changes on 30 September 2026

The Data (Use and Access) Act 2025 replaces the office of the Information Commissioner with a new body, the Information Commission. The date was set by commencement regulations made on 10 September 2026:

“The following provisions of the Data (Use and Access) Act 2025 come into force on 30th September 2026—”

The list that follows includes "section 118 (abolition of the office of Information Commissioner)" and "section 119 (transfer of functions to the Information Commission)". Section 119 is one sentence long where it matters: "The functions of the Information Commissioner are transferred to the Information Commission."

For the fee, a separate set of consequential amendments changes two words in the charging rules, "in regulation 2(2) and (3), for “Information Commissioner” substitute “Information Commission”". The amounts do not change.

What you need to do on the day: nothing. The commencement regulations carry everything over. Anything done by or in relation to the Information Commissioner, including anything "which, immediately before 30th September 2026, is in the process of being done", is to be treated as done "by or in relation to the Information Commission". If you have paid, you have paid. Your next renewal will simply come from a body with a slightly different name.

The same Act has been arriving in pieces all year. It raised the maximum fines for nuisance calls and marketing emails from 5 February 2026, which we covered in PECR fines went up to £17.5m.

Do you need to pay the data protection fee?

The rule is in the Data Protection (Charges and Information) Regulations 2018. A data controller, which for most small businesses means the business itself, must pay "unless all of the processing of personal data they undertake is exempt processing".

Read that twice, because the word doing the work is all. Being exempt for most of what you do is not enough. If even one of your reasons for holding personal data falls outside the list below, you pay, and you pay for the lot.

Who is exempt from the ICO fee

The exemptions are in the Schedule to the regulations, headed Exempt Processing. These are the ones that matter to most small businesses, in plain English, with the key words quoted:

• Paper only. Personal data "which is not being processed wholly or partly by automated means". A card index in a drawer is exempt; the same list in a spreadsheet is not, unless another exemption covers it.
• Your staff. Processing "for the purposes of matters of administration in relation to the members of staff and volunteers", which covers payroll and personnel records.
• Your own marketing. Processing "for the purposes of advertising, marketing and public relations in respect of the data controller's business".
• Your own accounts and customers. "keeping accounts, or records of purchases, sales or other transactions", "deciding whether to accept any person as a customer or supplier", and "making financial or financial management forecasts". There is one carve-out: data from a credit reference agency does not count.
• Not-for-profits, for processing to do with their own members, supporters and activities.

The list also covers personal and household use, public registers, judges and elected representatives, which rarely apply to a business. And handing data over because the law or a court requires it does not, on its own, take you outside an exemption.

The number under the number: a small shop whose only personal data is its staff records, its own mailing list and its customer accounts could be entirely exempt. The same shop with CCTV recording the street for security is a different matter, because nothing on the list covers it. That is our reading of the list, not the regulator’s guidance, which we could not read (more on that below).

How much is the ICO fee?

Three tiers, set in regulation 3 and last raised on 17 February 2025 by amending regulations that took them from £40, £60 and £2,900:

• Tier 1, micro: "(micro organisations), is £52".
• Tier 2, small and medium: "(small and medium organisations), is £78".
• Tier 3, large: "(large organisations), is £3,763".

And a discount that is easy to miss: "The applicable charge in paragraph (1) is reduced by £5.00 for a data controller that makes payment of the charge by direct debit."

Which tier you are in is where summaries often go wrong. You are in tier 1 if your turnover is "less than or equal to £632,000", or your staff number is "less than or equal to 10", or you are a charity or a small occupational pension scheme. Any one of those is enough. A business with twelve staff and a turnover of £400,000 is still tier 1. Tier 2 is anyone left with a turnover up to £36 million or up to 250 staff, and tier 3 is everyone else.

When to pay

Each charge period is twelve months. For a business that starts processing personal data now, the first period begins on the day it becomes a data controller, and the rule for every period is the same: pay "Within the first 21 days of each charge period". With the payment you give your name and address and which staff and turnover bands you are in.

What happens if you do not pay

The regulator can issue a fixed penalty. The amounts are not in the regulations; the Data Protection Act 2018 makes the regulator publish them in a separate document, and section 158 sets the ceiling:

“The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.”

By our arithmetic, 150% of £3,763 is £5,644.50. That is the legal cap, not necessarily the penalty for a small business, which could be lower; the actual figures are in the regulator’s published document, which we could not read.

What argues the other way

• We read the law, not the regulator’s guidance. The ICO’s website does not load for our tools, so everything here comes from legislation.gov.uk. The regulator’s guidance may interpret the exemptions in ways a plain reading of the list does not show. Check it before relying on an exemption.
• This is not legal advice. We are an AI company explaining what a regulation says. If a lot turns on whether you are exempt, ask someone who can be held to their answer.
• We have not seen how the switchover is being communicated. We could not read the ICO’s own announcements, so we are not saying anything about new web addresses, logos or letters. If something arrives from the Information Commission, it is the same regulator under its new name.

Sources, and what we checked

• The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/1015, made 10 September 2026.
• The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026, S.I. 2026/386, and section 119 of the Data (Use and Access) Act 2025.
• The Data Protection (Charges and Information) Regulations 2018 as currently in force, the amending regulations of 2025 and section 158 of the Data Protection Act 2018.
• All read on legislation.gov.uk in their full machine-readable text on 27 September 2026, and read again on 29 September 2026, the day this was published, when the text of all six was unchanged. Every quotation above was tested automatically against that text before publication. The ICO’s own website could not be read by our tools.