The new data protection fee – ICO cracks down on non-payment!

The Information Commissioner’s Office (ICO) has recently issued 34 enforcement notices to organisations who have failed to pay the new data protection fee under the GDPR and Data Protection Act 2018 (DPA 2018). We understand that more such enforcement notices are to follow soon.

These enforcement notices serve as a reminder to organisations that the ICO is taking GDPR and DPA 2018 enforcement seriously and is committed to ensuring organisations are aware of (and comply with) their obligations!

What is the data protection fee?

Under the old legislation (the Data Protection Act 1998) all data controllers had to be registered with the ICO and paid a fee for this registration based on the size and turnover of the organisation (£35 or £500), which was renewed on an annual basis.

Under GDPR and the DPA 2018, the requirement to register with the ICO has been removed and organisations no longer need to notify/register with the ICO but instead must pay a fee – the “data protection fee” depending on the size of the organisation.

This fee was established under the Data Protection (Charges and Information) Regulations 2018 and came into force, alongside the GDPR and DPA 2018, on 25 May 2018 (see our earlier blog on this here)

There are three tiers of fee charged by the ICO, depending on the size of the organisation:

Tier 1 (Micro organisations) – these are organisations with a turnover of less than £632,000 or that have no more than 10 staff = £40 fee (or £35 if you pay by direct debit).

Tier 2 (SMEs) – these are organisations with a turnover of less than £36 million or that have no more than 250 staff = £60 fee.

Tier 3 (Large organisations) – these are organisations with more than 250 staff or a turnover of more than £36 million = £2,900 fee.

Do I have to pay it?

In short – yes. If you process personal data, you need to pay the data protection fee[i].

If you have an existing registration under the old legislation which was renewed prior to 25 May 2018, you do not need to pay the new data protection fee until your registration expires.

What happens if I don’t pay?

If you don’t pay – you could be one of the organisations on the receiving end of an enforcement notice from the ICO. This first batch of 34 notices will serve as a reminder to many organisations to pay the data protection fee. The ICO has made clear that more notices are at the drafting stage and will be issued soon.

Failure to pay the data protection fee may result in a fine from the ICO – this will be calculated based on the size of your organisation but could be as much as £4,350!

All of the organisations who have been sent these enforcement notices have 21 days to respond – if they pay the ICO will stop the enforcement action.


This action by the ICO should serve as a reminder to organisations that the new data protection fee must be paid or you risk fines/other enforcement action by the ICO.

The new GDPR and DPA 2018 obligations for organisations can be confusing, however it is clear that if you are processing personal data – you should be paying the data protection fee to the ICO!

If you require any advice and/or assistance in relation to the GDPR or DPA 2018, please do not hesitate to get in contact with our dedicated data protection team who would be delighted to assist.

[i] There are a limited number of exemptions.

This article we co-written by Rebecca Henderson.

Technology, Media & Telecoms

With very few areas not impacted by technology, media and telecoms, we remain focused on ensuring we stay ahead of the curve in advising clients of the ever-increasing body of law, regulation and policy affecting the sector.

Latest updates from @MacRoberts

  • Our award-winning Family Law team can help you and your partner through difficult situations by providing support w… 27/07/2021
  • To celebrate the Olympic Games in Tokyo, we're delighted to launch our latest sporting challenge in support of our… 23/07/2021
  • MacRoberts is recruiting! We are currently looking for a Real Estate Planning Solicitor to join the MacRoberts tea… 23/07/2021
  • The countdown is on! With just 100 days to go, we’re looking forward to #COP26 in Glasgow! ♻️ As a firm accredite… 22/07/2021
  • Has lockdown led you to consider a move to the countryside? From discussing a possible purchase to obtaining the… 22/07/2021
  • Have you seen our latest vacancies? 💼 We currently have opportunities in various departments across the firm. Fin… 21/07/2021
  • Acas has published new guidance for employers with helpful information on #flexibleworking & #hybridworking. With t… 20/07/2021
  • Busting the myth that a career in law is only for the privileged few: @marikaflawyer is speaking at this morning’s… 19/07/2021
  • MacRoberts is recruiting! We are currently looking for a Support Services Assistant to join our team in Edinburgh.… 16/07/2021
  • MacRoberts is pleased to have been part of the team advising @HV_Systems in its £5m capital boost from Beehive Equi… 15/07/2021
  • MacRoberts is recruiting! We are currently looking for a NQ Solicitor to join our Conveyancing & Private Client te… 14/07/2021
  • For the last of our IGTV mini-series, we hear from Katie MacLeod. She will be giving an insight into what it’s like… 14/07/2021
  • RT @marikaflawyer: Exciting opportunity for Associate in our award winning Family Law team #familylaw #LegalCareer 14/07/2021
  • MacRoberts is recruiting! We are currently looking for an Associate to join our Family Law team in Edinburgh or Gl… 14/07/2021
  • Last week, the UK Government took the decision to relax the rules on the length of time lorry drivers can work as a… 13/07/2021