£52 a year for most small businesses, or £47 if you pay by direct debit. That is the tier 1 data protection fee, for organisations with a turnover of no more than £632,000 or no more than 10 staff. Having a website does not by itself trigger the fee. Holding personal information about customers to run your business usually does, unless every use you make of it falls inside one of the exemptions. The fee is still paid through ico.org.uk, even though the regulator became the Information Commission on 30 September 2026.
How much is the ICO data protection fee in 2026?
Three tiers, set by Parliament under the Data Protection (Charges and Information) Regulations 2018. Figures from the regulator’s own guide, checked 21 October 2026:
| Tier | Who | Fee a year | By direct debit |
|---|---|---|---|
| Tier 1, micro | Turnover up to £632,000, or no more than 10 staff | £52 | £47 |
| Tier 2, small and medium | Turnover up to £36 million, or no more than 250 staff | £78 | £73 |
| Tier 3, large | Everyone else | £3,763 | £3,758 |
Note the “or”. A business with a turnover over £632,000 but only six staff still falls into tier 1. Charities and small occupational pension schemes pay the tier 1 fee whatever their size.
Do I need to pay the ICO fee because I have a website?
Not because of the website itself. The fee is triggered by processing personal data as a controller, which almost every business that keeps customer details does, whether or not it has a website. What a website changes is how much personal data you collect: contact forms, bookings, newsletter lists, customer accounts and online orders all add to it.
Who is exempt from the data protection fee?
You do not have to pay if you only process personal data for one or more of these purposes, according to the regulator’s list of exemptions:
- staff administration
- advertising, marketing and public relations for your own business
- accounts and records
- not-for-profit purposes
- personal, family or household affairs
- maintaining a public register
- judicial functions
- processing done without an automated system such as a computer
The word that catches people out is “only”. If you also hold customer records in order to deliver a service, run CCTV, or keep information about clients beyond what your accounts need, the exemption usually stops applying. The self-assessment works it out in a few minutes.
Is a sole trader exempt from the ICO fee?
No. Sole traders are named specifically in the regulator’s guidance as organisations that need to pay unless they are exempt. Being small puts you in tier 1, it does not take you out of the fee.
How are staff counted for the data protection fee?
Broadly. “Members of staff” includes employees, workers, office holders and partners, and it does not matter whether they are based in the UK or overseas. You work out the average across your financial year: add up the number of staff in each completed month and divide by the number of months. Each part-time member of staff counts as one.
Does being exempt mean I can ignore data protection?
No. The regulator says plainly that exempt organisations still have to comply with their other data protection obligations. Exemption from the fee is only exemption from the fee. You still need a privacy notice, a lawful basis for what you do, and a way to deal with people’s requests about their data.
What happens if I don’t pay the fee?
The regulator can issue a monetary penalty for non-payment, and has a dedicated page for paying those penalties. It also treats every controller as a tier 3 fee payer until they say otherwise, so if you need to pay, it is worth paying at the right tier rather than waiting to be assessed.
Is the fee different now the ICO is called the Information Commission?
Not as at 22 October 2026. The renaming on 30 September 2026 changed the body’s legal name. The fee amounts, tiers and the place you pay are the same.
General information as at 22 October 2026, from the regulator’s own published guidance. Use the self-assessment for your own position.
More on website law and tax: do you need a cookie banner, does your website need a privacy policy, are website costs tax deductible, can you reclaim VAT on a website.
Get web & SEO tips that actually move the needle
Short, occasional emails for business owners: what's changing in Google, how to win more enquiries, and the fixes worth your time. No spam, no jargon.