The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

If you are reading this page, you are probably in the administrative and support service activities sector and have recently received a letter from the ICO.

As the UK’s data protection regulator, we are contacting all organisations that appear to need to pay a fee under data protection legislation.

All businesses and other organisations that process personal information should pay the annual data protection fee, unless they are exempt. The fee applies no matter how big, or small, your business or organisation is, although not everyone has to pay the same amount.

If you've paid in the last 14 days, please ignore the letter asking you to pay. If you have paid by card or direct debit, it can take up to 24 hours to receive confirmation. You will need to renew your fee every 12 months.

What is data protection?

The information you hold about your customers and clients is one of your biggest assets. If you want to make the best use of it, you need to be aware of your responsibilities.

Data protection isn’t just about paying the fee. It is the fair and proper use of information about people. Understanding it will help you use that data effectively, so you can provide the products and services your customers want and need. It will also help you use that data safely. Mistakes can be expensive to put right. They can also be damaging to clients and threaten your reputation as a business that puts its customers first.

The UK data protection regime is set out in the Data Protection Act 2018 and the UK GDPR.

What is 'personal data'?

Personal data is information about particular living individuals. This might be anyone, including customers, clients, employees, business partners, members, supporters, business contacts, public officials or members of the public.

It does not need to be 'private' information – information which is public knowledge or which is about someone's professional life can be personal data too.

It includes records held electronically (such as on computers, laptops, smartphones or cameras) as well as paper records, if you plan to put them on a computer or other electronic device or if you file them in an organised way.

Does data protection apply to me?

Yes, if you have information about people for any business or other non-household purpose.

Data protection law applies to any 'processing of personal data', so will apply to most businesses and organisations, whatever their size. But there are some exemptions from the obligation to pay.

What do I need to do?

If you have received a letter from us, quoting your Companies House registration number you must:

Our self-assessment tool will help you work out if you need to pay. We have also added some frequently asked questions below.

If you do need to pay, the online form will ask for your sector. You can choose, but are not limited, to:

  • Transport and Leisure, Passenger Transport, Car Rental
  • Transport and Leisure, Holiday Provider and Service,
  • Retail and Manufacture, Supplier of goods, Mail Order Trader
  • Retail and Manufacture, Supplier of goods, E-Commerce
  • Retail and Manufacture, Supplier of goods, Retail/Wholesale
  • Retail and Manufacture, Manufacturing, Manufacturer
  • General Business, Recruitment Agency, Employment Agency
  • General Business, Supplier of services, Curriculum Vitae Services
  • General Business, Business Advice and Consultancy, Consultant
  • General Business, Security, Security Company/Provider
  • General Business, Private Investigator, Private Investigation & Debt Administration and Factoring
  • General Business, Private Investigator, Private Investigation
  • General Business, Supplier of services, Other
  • Finance, Insurance and Credit, Insurance, Claims Investigator
  • Finance, Insurance and Credit, Credit Referencing, Credit Reference Agencies

Frequently asked questions

I have CCTV on my business premises for crime prevention reasons – do I need to pay a fee?

Yes. Images of people caught on camera is their personal data. If you record these images to prevent crime, and crime prevention is not the purpose of your business, then you need to pay.

We are an organisation which operates renting and leasing of assets, such as vehicles and business equipment – do we need to pay?

If you do credit checks on customers via a credit reference agency this would require you to pay a data protection fee.

If you have CCTV for the purpose of crime prevention on or in the premises this would require your company to pay the fee.

I do credit checks on my clients – do I need to pay?

Yes. When performing a credit check via a credit reference agency you will need to pay the fee.

If I email promotional offers to customers – do I need to pay? 

There is an exemption for processing personal information for the purpose of advertising or marketing your business activity, goods or services and promoting public relations only in connection with that business activity, or those goods and services. This processing does not require you to pay the fee.

If you use your business to promote another person's business activity, goods, or services, you will need to pay because you are advertising and marketing for others and this would require you to pay the fee.

I run a casting agency – do I need to pay?

Yes, as a casting agency you are likely to hold records of actors which would include headshots, videos and audition tapes and categorise them according to their ages, looks and abilities. This is a non-exempt purpose and you would be required to pay a data protection fee.

We are an employment agency – do we need to pay?

Yes, collecting personal information and creating client profiles then referring and placing applicants for employment would require you to pay a data protection fee.

You would not be able to rely on the staff administration exemption.

We provide human resource services for our clients – do we need to pay?

Yes, whilst providing human resource activities for your clients, such as employment law advice, health and safety services and legal representation, you are the data controller of the personal data that is supplied to you and would be required to pay a fee.

You would not be able to rely on the staff administration exemption.

We are a tour operator/travel agent – do we need to pay?

If you are providing a consultancy and advisory service, such as creating specialised itineraries, providing specialist advice, building a package for your customers and helping your customers when things go wrong on their holiday, you would be required to pay a data protection fee.

If you sell holiday insurance from a third party, you are required to pay a data protection fee.

If you have CCTV for the purpose of crime prevention on or in your business premises this would require you to pay the fee.

If you simply book holidays for your customers and take payments and do not carry out any of the above processing you are not required to pay a fee.

I own a private security company which may include services such as close protection bodyguards, surveillance, door supervision, and, security management and consultancy for my clients – do I need to pay?

Yes, you are required to pay a data protection fee when processing personal information these purposes.

I operate a security system service where I install, repair and monitor security equipment such as CCTV for my clients.  Do I need to pay a fee?

Yes, you are required to pay a data protection fee if you provide a monitoring service. However, if you only install and repair the equipment you are not required to pay a fee. It is the responsibility of the organisation where you have installed the security equipment to determine if they are required to pay a fee. 

I am a private investigator – do I need to pay a fee?

Yes, if you are processing personal information when carrying out your duties such as surveillance, fraud investigation, tracing missing people and interviewing then you are required to pay a data protection fee.  

I provide facilities support activities – do I need to pay?

If you are providing services such as interior cleaning and trash disposal, and no personal data is being processed you would not be required to pay a data protection fee.

If you have CCTV for the purpose of crime prevention on or in your business premises this would require you to pay the fee.

If you keep records of maintenance issues that have been raised by your clients and their staff, you may be required to pay.

My company provides resident property management – do I need to pay?

If you are processing information such as:

  • Holding personal details on each residents
  • Financial payments – e.g. how much each resident pays into the account
  • Maintenance requests
  • Decisions on what suppliers to use e.g. builder/gardener
  • How much to spend on each area of the property
  • Dispute resolution between residents
  • CCTV for crime prevention
  • Meeting notes

You are required to pay a fee. This processing is for the purpose of property management and you are unable to rely on an exemption.

I manage a commercial property – do I need to pay?

If you have CCTV for crime prevention then you would be required to pay a fee.

My company provides office administrative services – do we need to pay?

If you are offering financial planning on a consultancy and advisory basis and your clients are sole traders or partnerships, then this would not be an exempt purpose for processing personal data and you would be required to pay a fee.

If you are providing services such as reception and mail services, but always acting under instruction from your client then you would not be required to pay a data protection fee.

We are a reservation services company – do we need to pay?

If you market on behalf of other businesses and take bookings on behalf of others, you would be required to pay a fee.

We take our own reservations – do we need to pay?

If you are only taking reservations for your own goods and services and are not promoting another business you are not required to pay a fee.

If you have CCTV for the purpose of crime prevention on or in your business premises this would require you to pay the fee.

I organise events, such as exhibitions, fairs and conferences- do I need to pay?

Yes, if you hold details of attendees, exhibitor information, advertising for other business services then you would be required to pay a fee.

If you are set up as a not-for-profit you may be able to rely on this exemption. If you use CCTV for crime prevention purposes you would be required to pay.

I provide a repossession and debt recovery service - do I have to pay?

If you are processing personal information for the purpose of collecting debts and reprocessing assets, you are required to pay a fee.

I offer consultancy services – do I need to pay?

Yes, providing consultancy and advisory services to individuals or  partnerships, such as branding and graphic design, is not an exempt purpose of processing personal data and you would be required to pay a fee.

I have a dashcam on my business vehicle – do I need to pay the fee?

If you have a dashcam that you use for work purposes on a vehicle that you use for work – even if you own the vehicle -  then you will need to pay a data protection fee. Again, images of people recorded on camera – even when in their cars - will be their personal data.

My company is dormant – do I need to pay?

It depends. If your business is dormant and you are not processing personal data electronically, then you’re not required to pay the fee.

However, some businesses and professionals are required to retain some personal data after they cease trading or practicing, as required by industry guidelines. If this applies to you then you probably will need to pay.

Please visit our self-assessment tool to check.

I am already registered – why have I received a letter?

If you are registered as a sole trader or your registration does not include your companies house number this could be the reason why you have received our letter. Please let us know.

I have a limited company but I’m a sole trader – who needs to be registered?

This depends on who the data controller is and which entity has the relationship with the client. You will need to determine who is the legal person responsible for the personal data held.

If your limited company is set up for the sole purpose of processing your own accounts through then this would not require a fee.

I’m unsure if I am data controller or a data processor – how do I determine this?

There is some detailed guidance that will help you make that decision: https://ico.org.uk/media/for-organisations/documents/1546/data-controllers-and-data-processors-dp-guidance.pdf

I have received a letter for one of my companies, however, I have a group of companies. Can I do a group registration?

It isn’t possible to have a group entry on the public register of data protection fee payers. Each individual company, if it is a data controller and a separate legal entity e.g. has a separate companies house number, would be required to pay a data protection fee unless an exemption applies.

More information

There is more information about the data protection fee on our website.

There is also lots of information for sole traders and smaller businesses on our SME web hub, to help you understand data protection and how it can help you safely make the most out of the personal data you hold.