The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

What is the data protection fee for?

We use the data protection fee to fund our data protection work. We do not keep any money we receive in fines, but pass it directly to the Government.

Do I have to pay a fee?

If you are a controller and the exemptions don’t apply to you, you will have to pay the fee.

How do I determine if my business is exempt?

Take our short self-assessment

How much do I have to pay?

The fees range from £40 to £2,900. The fee depends on the size of your organisation, your turnover and, in some cases, the type of organisation you are. It’s structured like this out of fairness.

Take our fee self assessment to determine what fee your organisation has to pay.

Who sets the fee?

The fee is set by Parliament and reflects what Parliament feels is appropriate, based on the risks that the processing of personal data presents.

When will I have to pay the new fee?

The new regulations came into effect on 25 May 2018, but this doesn’t mean that everyone has to pay us a fee now. Controllers with a current registration (or notification) under the DPA 1998 will not have to pay any other fee until their notification has expired (12 months from the day they made it). Controllers that are not currently notified are now liable for the new fee, unless an exemption applies.

If I renewed under the old arrangements do I have to pay again now?

If you renewed or registered before 25 May 2018 under the DPA 1998, that registration will be valid for 12 months. You will not need to pay the new fee until your current registration expires.

How long will I be covered?

Your fee covers a 12 month period from the renewal date (not the payment date), but we will not regard you as covered until we receive a payment we can attribute to you.

What is the difference between notifying under the Data Protection Act 1998 and paying the data protection fee?

Aside from the level of the fee, the main difference is that under the DPA 1998 , controllers had to give details of the types of processing they did . You do not now need to provide this information.

How often do I have to pay the data protection fee?

Every 12 months.

How will I know my renewal is due?

We will email you before your previous payment expires and your new payment is due.

Does the fee include VAT?

No. Statutory fees are outside the scope of VAT, so no VAT is charged on it.

How can I check that my fee level has been based on the correct information?

If you already have a current registration, we will write to you before it is due to expire, letting you know that you will soon need to pay the new data protection fee. In the renewals paperwork we send you, we will have made a preliminary decision as to which tier we think you will now belong to, based on the details you previously gave us. If you think this is wrong, you should let us know by calling our helpline on 0303 123 1113. You can search for your current registration on our website.

Do you issue refunds?

Only in exceptional circumstances. Please get in touch with us as soon as possible.

What happens if I don’t pay my fee?

We will send you a reminder explaining when you need to pay. If you don ’t pay, or tell us why you are no longer required to pay a fee , we will issue a notice of intent 14 days after expiry. You will have 21 days to pay or make repre sentations. If you do not pay or fail to notify us that you no longer need to pay, you may be issued with a fine of up to £4,350 (150% of the top tier fee).