The Information Commissioner’s Office (ICO) is the regulator of data protection and other information rights legislation and is sponsored by the Department for Science, Innovation and Technology (DSIT).
Under the Data Protection (Charges and Information) Regulations 2018, organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt. This fee is used to fund the ICO's statutory responsibilities in providing advice and guidance about how to comply with the law.
These fees have not increased since 2018, and their real-term value has reduced substantially due to inflationary pressures, while the ICO’s costs have increased annually. Furthermore, the ICO must continue to invest in organisational transformation and upskilling so that it can keep pace with emerging regulatory issues, maintain a robust and supportive regulatory environment for organisations and help individuals assert their data rights.
Consultation by DSIT on the proposed changes to the data protection fee regime
Between 29 August and 3 October 2024, the government undertook a consultation on proposed changes to the data protection fee regime. It sought views on proposals to increase (for the first time since 2018) the fees payable by data controllers to the ICO by 37.2%, to take account of inflationary increases and in order to provide the ICO with the necessary funding to discharge their legal responsibilities. A total of 103 responses were received, including the ICO’s own response.
On 27 January 2025, the Data Protection (Charges and Information) (Amendment) Regulations 2025 (the Regulations) were laid before Parliament with a view to bringing the new fees into effect in early 2025.
The government has considered the feedback received alongside the need to provide the ICO with financial stability to support organisations to comply with their data protection obligations.
Three tiers of the data protection fee regime
There are three tiers of the data protection fee regime set by Parliament to reflect the risks posed by the processing of personal data by controllers.
The tiers are based on:
- How many members of staff you have;
- Your annual turnover;
- Whether you are a public authority;
- Whether you are a charity; or
- Whether you are a small occupational pension scheme
After detailed analysis, the government has decided to:
- Introduce legislation to increase the data protection fees across all tiers by 29.8%, as set out in the table below;
- Retain the existing three-tier structure, including the applicable criteria for determining fees payable;
- Retain the £5 discount applicable to Direct Debit payments across all tiers; and
- Retain the current exemptions from the requirement to pay a fee.
Data protection fee increases
The increase is below the 37.2% uplift the government consulted on, and below historic RPI increases since 2018. The table below shows the current fee and the new fee being introduced.
| Tier | Current Fees | New Fees |
|---|---|---|
| 1 | £40 | £52 |
| 2 | £60 | £78 |
| 3 | £2,900 | £3,763 |
Ensuring that the ICO is sufficiently resourced includes further investment in areas highlighted by some respondents to the consultation, such as innovation services and regulatory sandboxes, bespoke tools and support to SMEs.
Proposed increases to Tier 1 fees
Approximately 90% or 1.1 million of the current fee payers are in Tier 1 and the fees payable by these organisations have not increased in line with inflation in 24 years. The government wants to ensure that the fees are proportionate and that regulatory costs are spread across data controllers, minimising costs on the smallest organisations as far as possible.
The government intends to proceed with increasing these fees at a lower rate of 29.8%. This means that the fee payable will go up from £40 to £52 per year, an increase of £12.
The ICO has a number of resources targeted at small organisations, including a small organisations hub which offers tailored guidance and toolkits, and is planning to expand on this work by developing new tools and services and improving their outreach to small organisations to raise awareness of the support available to them and ensure value for money.
Proposed increases to Tier 2 fees
The government intends to proceed with increasing Tier 2 fees at a lower rate of 29.8%. This means that Tier 2 fee payable will go up from £60 to £78 per year, an increase of £18.
Proposed increases to Tier 3 fees
Tier 3 captures organisations with more than 250 staff and more than £36 million annual turnover. Large organisations are generally more likely to handle larger volumes of personal data and undertake higher risk processing and are therefore expected to put a higher strain on the ICO’s resources.
The government intends to proceed with increasing the fees for Tier 3 at a lower rate of 29.8%. This means that the fee payable will go up from £2,900 to £3,763 per year, an increase of £863.
How we can help
If you need advice around your data protection obligations, or guidance on the changes being introduced, please don’t hesitate to contact us.
