Data protection fee (ICO registration)

Where this applies

This record is scoped to United Kingdom. Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.

Instrument

The Data Protection (Charges and Information) Regulations 2018, amended by SI 2025/63 (in force 17 February 2025)

Who it binds

Organisations that process personal data, unless exempt. The fee is paid to the Information Commissioner's Office and extends to England & Wales, Scotland and Northern Ireland.

What it requires

Organisations that process personal data must pay an annual data-protection fee to the ICO unless exempt. It is a statutory fee, not a certificate. The current fee amounts are being re-verified against the ICO's own source and are not published here.

Related records and requirements

• Technology and Data — Applies to organisations that process personal data and aren't exempt.
• Finance and Professional Services — Applies to organisations that process personal data and aren't exempt.
• Healthcare — Applies to healthcare providers processing patient data — organisations that process personal data and aren't exempt.
• Data controller registration (Malaysia) — Malaysia's covered classes of data users must register as data controllers with the JPDP and display the registration certificate — limited to 13 legally specified classes.
• VERBİS registration under the KVKK (Türkiye) — Türkiye's Art. 16(2) requires registration with the Data Controllers' Registry (VERBİS) before processing personal data begins — separate from KVKK's substantive compliance rules.