Paying a data protection fee – education sector

If you do need to pay, the online form will ask for your organisation details and sector. You can choose, but are not limited, to:

Education and Childcare, Academy and Free School, Academy
Education and Childcare, Academy and Free School, Free School
Education and Childcare, Community School, Community School
Education and Childcare, Further Education, Further Education/6th Form Colleges
Education and Childcare, Tutor, Home Tutor
Education and Childcare, Maintained School, School
Education and Childcare, Maintained School, Voluntary Controlled School
Education and Childcare, Private School, School (Private)
Education and Childcare, Higher Education, University
Education and Childcare, Training Company, Training Company
Education and Childcare, Careers Service, Careers Service
Education and Childcare, Childminder, Childminder
Education and Childcare, Nursery, playgroup and Afterschool Club, Nursery, playgroup, and Afterschool Club
Membership Association, Club, Club/Society (Charitable)
Membership Association, Club, Membership Club (Commercial)

Frequently asked questions

I am already registered – why have I received a letter?

If you are already registered as a sole trader or your registration does not include your companies house number this could be the reason why you have received our letter. Please let us know.

I have a limited company but I’m a sole trader – who needs to be registered?

This depends on who the data controller is, and which entity has the relationship with the client. You will need to determine who is the legal person responsible for the personal data held.

If your limited company is set up for the sole purpose of processing your own accounts through, then this company would not require a fee.

I have CCTV on my business premises for crime prevention reasons – do I need to pay a fee?

Yes. Images of people caught on camera is their personal data. If you record these images to prevent crime, and crime prevention is not the purpose of your business, then you need to pay.

My organisation is a registered charity – do I need to pay?

This would depend on what personal data you were processing and why. A registered charity would only pay the lowest fee tier of £40. Our self-assessment tool will help you determine if you are required to pay a fee.

How do I know if my company can claim the not-for-profit exemption – we don’t make a profit?

To meet the criteria for the not-for-profit exemption the organisation must:

be established as a not-for-profit organisation, which may be stated in your constitution/articles
only process information necessary to establish or maintain membership or support
only process information necessary to provide or administer activities for people who are members of the organisation or have regular contact with it
only hold information about individuals whose data you need to process for this exempt purpose
the personal data you process is restricted to personal information that is necessary for this exempt purpose
only keep the information while the individual is a member or supporter or as long as necessary for member/supporter administration

The organisation would not be exempt:

if you are responsible for CCTV
if you provide additional services outside of the organisations aims/objectives that can’t be covered by the other exemptions
if you trade and share in personal data

My company/club/society/association holds information about our members – do we need to pay?

The administration of membership records is not an exempt purpose for processing personal data and would require a fee to be paid. If you are set up as a not-for-profit organisation, please look at our not-for-profit question above.

If you have CCTV for the purpose of crime prevention on or in the premises this would require your company to pay the fee.

We are a community interest company – do we need to pay?

Community interest companies are unlikely to be able rely on the not-for-profit exemption and you must determine which level of fee you are required to pay.

You can complete the self-assessment tool to determine this.

We are an educational establishment, such as a college or university – do we need to pay?

Educational establishments, such as schools, colleges, and universities, are often data controllers in their own right, and would be required to pay the fee.

If you are a registered charity, you would only pay the lowest fee tier of £40.

If you are a college which is part of a university, you will need to determine if you are a separate legal entity and required to pay a separate fee.

If you have CCTV for the purpose of crime prevention on or in the premises this would require you to pay the fee.

We are a private/independent school – do we need pay?

Yes, if your school is responsible for student records, including any bursary or scholarship processes, you would be required to pay the data protection fee.

If you are a registered charity, you would only pay the lowest fee tier of £40.

If you have CCTV for the purpose of crime prevention on or in the premises this would require you to pay the fee.

If you are part of a multi academy trust, please see FAQ below.

We are a multi academy trust (MATs) – do we need to pay?

We understand that under the Multi Academy Trust (MAT) arrangements, the MAT is responsible for the activities of all the schools in the MAT; even though some functions may have been delegated to local Heads of School or Local Governing Bodies. Ultimate responsibility lies with the MAT.

Providing the schools and academies within the MAT do not have any legal status separate from that of the MAT, the MAT is the legal entity responsible for the processing of personal data by the schools and the academies. The MAT would be the data controller for the processing and is the entity subject to DPA registration obligations.

If the schools or academies within the MAT are not separate legal entities, we also recommend that the schools or academies within the MAT are shown as trading names on the MAT entry. It is important that parents and children see who is responsible for processing of personal data.

I am a tutor – do I need to pay?

If you have set up a company and keeping educational records on your students’ progress this would require a data protection fee, whether this is a limited company or you as a sole trader.

You are not required to pay a fee if your company is only for the purpose of your own accounts and payments.

I am an educational psychologist – do I need to pay?

If you are processing personal information electronically whilst supporting children and young people with their emotional and social wellbeing, you are required to pay a fee.

We are a company that provides therapy, such as occupational, speech and language and animal assisted therapy – do we need to pay?

If you are responsible for the medical records held including any treatment and care received, you would be required to pay the fee.

I offer training – do I need to pay?

Yes, if you are providing advice and creating bespoke training plans which includes personal information, you would be required to pay a data protection fee.

I run a dance school – do I need to pay?

Yes, if you hold a personal record of your student’s development, including examination results then a fee would be required.

If you are set up as a not-for-profit you may be able to rely on this exemption. However, if you use CCTV for crime prevention purposes, you would be required to pay.

I am a driving instructor – do I need to pay?

If you hold electronic progress reports for your clients, you would be required to pay the fee.

If you have a dashcam or CCTV in or on any business premises or business vehicles, you would be required to pay the fee.

We are a day care/nursery – do we need to pay?

Yes, if you take digital material/photographs of the children; hold and process the child’s progress, learning and development or use the contact details to send updates via texts and emails on the child’s progress and development, you are required to pay the fee.

Afterschool club – do we need to pay?

Yes, if you are holding records for children attending the club, you would be required to pay the fee.

However, if the afterschool club is ran by the school itself then a fee would not be required.

I am a sports coach – do I need to pay?

If you are holding a record of development electronically, you would be required to pay the fee.

My sports club advertise our sponsors services on our website – do I need to pay?

If your sponsors are sole traders or partnerships, then there would be a requirement to pay the fee. This is advertising and marketing for others and a non-exempt purpose for processing personal data.

If you are set up as a not-for-profit you may be able to rely on this exemption. However, if your sports club has CCTV for crime prevention purposes you would be required to pay.

I’m a childminder – do I need to pay?

A childminder does have to pay the data protection fee if they:

take digital material/photograph of a child.
hold and process the child’s progress, learning and development; or
use the contact details to send updates via texts, emails on the child’s progress and development throughout the day.

I’m a nanny – do I need to pay?

If you are a nanny employed by a family then you do not need to pay a data protection fee.

If you have set up a limited company to process your accounts and payments only there is no requirement to pay a data protection fee.

My company is dormant – do I need to pay?

It depends. If your business is dormant and you are not processing personal data electronically, then you’re not required to pay the fee.

However, some businesses and professionals are required to retain some personal data after they cease trading or practicing, as required by industry guidelines. If this applies to you then you probably will need to pay.

Please visit our self-assessment tool to check.

More information

There is more information about the data protection fee on our website.

There is also lots of information for sole traders and smaller businesses on our SME web hub, to help you understand data protection and how it can help you safely make the most out of the personal data you hold.