Tools
ICO Fee Calculator: Your 2026 Data Protection Fee Tier
Most UK organisations that hold personal information on a computer owe the Information Commissioner's Office a yearly data protection fee, and most small ones pay £52 or £78. The tier tests are easier to pass than people expect: you only need to meet one of the two tests, turnover or staff, so a 40-person firm with £500,000 turnover is still tier 1. The part that catches businesses out is the exemption. Staff admin, your own marketing and your accounts are exempt, but a security camera over the shop door or a file of client records usually is not. Answer the questions below to see whether you need to pay and how much.
Do you need to pay the ICO fee, and which tier?
Include employees, workers, directors and partners; each part-timer counts as one. Sole trader with no employees: enter 1.
For your most recent financial year. Enter 0 if you have not traded yet.
| Your tier | |
|---|---|
| Standard annual fee | |
| By direct debit | |
| What you pay |
Fees as set from 17 February 2025 under the Data Protection (Charges and Information) Regulations 2018. This is a guide, not legal advice: the ICO's own self-assessment on ico.org.uk gives the final answer, and it is the body that registers you.
How the three fee tiers work
The fee is set by the Data Protection (Charges and Information) Regulations 2018 and was last raised on 17 February 2025. You pay it once a year and the ICO takes £5 off if you pay by direct debit.
| Tier | Who it covers | Annual fee | By direct debit |
|---|---|---|---|
| Tier 1 (micro) | Turnover of £632,000 or less, or 10 staff or fewer. All charities and small occupational pension schemes. | £52 | £47 |
| Tier 2 (small and medium) | Turnover of £36 million or less, or 250 staff or fewer | £78 | £73 |
| Tier 3 (large) | Everyone who meets neither test above | £3,763 | £3,758 |
Two details matter. First, the word "or": a business with 60 staff and £400,000 turnover passes the tier 1 turnover test, so it pays £52. Second, public authorities ignore turnover and go by staff numbers alone.
Counting your staff
The ICO asks for your average headcount across the financial year: add up the number of staff you had each month and divide by the number of months. Staff means employees, workers, office holders such as directors, and partners. A part-timer counts as one person, the same as a full-timer.
Who is exempt
You do not have to pay if the only things you use personal information for are on the exempt list in the regulations: running your own staff and volunteers, advertising and marketing your own business, keeping accounts and records of sales and purchases, deciding whether to take someone on as a customer or supplier, keeping up a public register, or a not-for-profit body keeping its membership and supporter records. Information held only on paper is exempt too.
The catch is that the exemption covers everything or nothing. A hairdresser who only keeps payroll and a booking list of customers' names may be exempt; add a CCTV camera for security and the fee is due. The same goes for an accountant holding client tax files, a landlord's tenant records or a clinic's patient notes, because those files are the service itself rather than a record of a sale.
What happens if you do not pay
Not paying when you should is a breach of the regulations, and the ICO can issue a fixed monetary penalty, which for tier 1 and tier 2 organisations costs several times the fee itself. It publishes the names of organisations it penalises. If you are unsure after using this calculator, the ICO's free self-assessment on its website takes around ten minutes and gives a definite answer.
Paying the fee is only the admin side of UK GDPR. If you are working out what your wider data protection obligations cost, our GDPR fine calculator shows your maximum penalty exposure, and the subject access request deadline calculator dates your reply to a SAR.
