Do you need to register with the ICO?

If your business handles personal data — customer email addresses, a mailing list, CCTV footage, employee records beyond the basics — the default position is yes: you must register with the Information Commissioner's Office (ICO) and pay the annual data protection fee.

How much the fee is

• £40 per year for micro-organisations (turnover under £632,000 and fewer than 10 staff)
• £60 per year for small and medium organisations
• £2,900 per year for the largest organisations

The fee is a legal requirement under the Data Protection Act 2018, separate from your wider UK GDPR compliance duties. Paying it does not make you compliant on its own — you still need a lawful basis for each type of processing, a privacy notice telling people what you do with their data, and a process for reporting serious breaches to the ICO within 72 hours.

Who is exempt

Some organisations do not need to pay because their processing falls entirely within narrow exemptions — for example, processing personal data only for staff administration, accounts and record-keeping, or advertising your own goods and services. In practice these exemptions are tight: the moment you use website analytics that collect IP addresses, run a marketing list, or operate CCTV, you are usually outside them. The safest approach is to run the ICO's free self-assessment tool at ico.org.uk, which asks a short series of questions and tells you whether you need to register.

Do not simply ignore the requirement. The ICO writes to unregistered businesses and can issue fines for non-payment, and being unregistered is an unhelpful starting position if a customer ever complains about how you handled their data. Fines for serious UK GDPR breaches can reach £17.5 million or 4% of global annual turnover, so registration is the cheap, easy part of data protection compliance — get it done and diarise the annual renewal.