Before the Register Check: A Director’s Review of ICO Data Protection Charges

Most compliance gaps announce themselves. A filing deadline passes, a confirmation statement is overdue, or a VAT threshold is crossed. The ICO data protection fee is different. It sits quietly behind ordinary business activity — a contact form, a customer database, a staff folder — and many directors assume that because they have never received an invoice, no charge applies.

That assumption is worth testing. The fee is not a subscription to good data protection practice, and paying it does not make a company compliant with UK GDPR. It is a separate statutory charge on data controllers, and the obligation can arise long before a company thinks of itself as “processing data” in any formal sense.

Who the charge is designed to catch

Under the Data Protection (Charges and Information) Regulations 2018, a data controller that processes personal data by automated means is generally liable to pay an annual charge to the Information Commissioner’s Office, unless a specific exemption applies. “Automated means” is broad. It covers a customer relationship management system, an email marketing list, cloud accounting records containing individual names, CCTV footage and many routine HR files.

For a UK company, the practical question is not whether data protection sounds like a legal department matter. It is whether the company decides why and how personal data is used. If it does, it is likely to be a controller. Holding names and email addresses in a spreadsheet for customer enquiries is enough to bring the question into view.

The ICO publishes fee tiers based broadly on size and turnover, with lower charges for smaller organisations and a higher charge for larger controllers. Directors should check the current published table before paying rather than relying on an old figure. The amount matters, but the more important issue is whether the company is on the register at all.

Where exemptions genuinely apply

Exemptions exist, but they are narrower than many founders hope. They tend to be purpose-specific: processing only for staff administration, only for advertising, marketing and public relations, or only for accounts and records, for example. A business that holds customer records to deliver a service, manage complaints or run a loyalty scheme is unlikely to be processing solely for one of those exempt purposes.

There are also exemptions connected with not-for-profit processing and certain other limited circumstances. These should be read carefully against the ICO’s current guidance. The dangerous approach is to assume that a small company, a low-risk business or a company that has never had a complaint is automatically exempt. Size alone does not remove the charge.

A useful discipline is to write down the exemption relied on, the processing it covers and the date the decision was reviewed. If the company later adds a marketing list, a HR system or a customer portal, the exemption may no longer describe what actually happens.

A 30-minute fix-it plan

This review can be done without a consultant, provided it is recorded properly. Set aside half an hour and work through the following steps.

1. List the personal data the company holds. Include customer names, enquiry emails, employee records, supplier contacts, CCTV and any marketing lists. Note where each set is stored and who decides how it is used.
2. Test the exemption question. If the company relies on an exemption, identify it precisely and check it against current ICO guidance. If the company holds customer records for service delivery, assume the exemption is unlikely to cover the whole business.
3. Search the ICO register. Check the company name and any trading names. Confirm whether an entry exists, whether the details are current and whether the fee has been paid for the present period.
4. Check the renewal date. The charge is annual. Put the renewal date in the finance calendar and, where possible, use the ICO’s direct debit facility so that the payment does not depend on an inbox reminder.
5. Record the evidence. Keep a copy of the register entry, the payment confirmation and any internal note explaining an exemption decision. A screenshot with a date is more useful than an undated assumption.
6. Assign ownership. Decide whether the finance lead, operations lead or a director owns the renewal. A named owner is better than “the admin team”.

If the company is registered, lapsed or unsure

A registered company should confirm that the entry reflects its current name, address and trading details. A lapsed entry should be corrected promptly rather than left until a tender questionnaire or a customer audit asks for evidence. An unsure company should start with the register search and the processing list, not with a guess.

Where a fee has been missed, the sensible response is to correct the position and keep a short record of what was found and what changed. The ICO has enforcement powers for failures to pay, and the penalty can be materially larger than the original charge. The aim is to prevent a small administrative oversight from becoming a procurement problem or a regulatory matter.

Why this matters beyond the ICO

Public sector buyers and larger private customers increasingly ask suppliers to confirm their data protection arrangements. A tender may ask for an ICO registration number or evidence that the charge is paid. A missing entry can delay a bid even where the underlying data practices are sound. The fee is therefore both a compliance obligation and a commercial readiness point.

For directors, the calm conclusion is straightforward. The ICO data protection fee is not a hidden trap, but it is easy to overlook because it does not always arrive as a prominent invoice. A short annual review — processing list, exemption test, register check, renewal diary and evidence file — is enough to make the position visible. In 2026, that visibility is worth more than a last-minute scramble.

This article is general information for UK businesses and is not legal advice. Companies with complex processing or uncertain exemption positions should take appropriate professional advice.