- What is the data protection fee for?
- Do I have to pay a fee?
- How do I determine if my business is exempt?
- How much do I have to pay?
- Who sets the fee?
- When will I have to pay the new fee?
- If I renewed under the old arrangements do I have to pay again now?
- What is the difference between notifying under the Data Protection Act 1998 and paying the data protection fee?
- Does the fee include VAT?
- How can I check that my fee level has been based on the correct information?
- What happens if I don’t pay my fee?
We use the data protection fee to fund our data protection work. We do not keep any money we receive in fines, but pass it directly to the Government.
If you are a controller and the exemptions don’t apply to you, you will have to pay the fee.
The fees range from £40 to £2,900. The fee depends on the size of your organisation, your turnover and, in some cases, the type of organisation you are. It’s structured like this out of fairness.
The fee is set by Parliament and reflects what Parliament feels is appropriate, based on the risks that the processing of personal data presents.
The new regulations came into effect on 25 May 2018, but this doesn’t mean that everyone has to pay us a fee now. Controllers with a current registration (or notification) under the DPA 1998 will not have to pay any other fee until their notification has expired (12 months from the day they made it). Controllers that are not currently notified are now liable for the new fee, unless an exemption applies.
If you renewed or registered before 25 May 2018 under the DPA 1998, that registration will be valid for 12 months. You will not need to pay the new fee until your current registration expires.
Your fee covers a 12 month period from the renewal date (not the payment date), but we will not regard you as covered until we receive a payment we can attribute to you.
What is the difference between notifying under the Data Protection Act 1998 and paying the data protection fee?
Aside from the level of the fee, the main difference is that under the DPA 1998 , controllers had to give details of the types of processing they did . You do not now need to provide this information.
Every 12 months.
We will email you before your previous payment expires and your new payment is due.
No. Statutory fees are outside the scope of VAT, so no VAT is charged on it.
If you already have a current registration, we will write to you before it is due to expire, letting you know that you will soon need to pay the new data protection fee. In the renewals paperwork we send you, we will have made a preliminary decision as to which tier we think you will now belong to, based on the details you previously gave us. If you think this is wrong, you should let us know by calling our helpline on 0303 123 1113. You can search for your current registration on our website.
Only in exceptional circumstances. Please get in touch with us as soon as possible.
We will send you a reminder explaining when you need to pay. If you don ’t pay, or tell us why you are no longer required to pay a fee , we will issue a notice of intent 14 days after expiry. You will have 21 days to pay or make repre sentations. If you do not pay or fail to notify us that you no longer need to pay, you may be issued with a fine of up to £4,350 (150% of the top tier fee).