# Do you have to pay the ICO fee?

Check the exemption first, then the right fee band, before paying a letter or invoice.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

**The short answer.** You generally pay the ICO data protection fee if you use personal data as a controller, unless an exemption applies. The annual bands are £52, £78 and £3,763. Paying by direct debit reduces the fee by £5 ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/) and [ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

## Does an ICO letter mean you have to pay?

No. The ICO says its letters remind organisations to check whether they need to pay. Use that check before deciding that the letter is a bill you owe ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

Pay the ICO directly if a fee is due. The ICO says payment agencies have no official standing or connection to it. You can use an agency, but it is not the regulator ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

## What are the current ICO fee bands?

Check the bands in order. For the first two bands, the test uses turnover or staff numbers. You do not have to meet both limits. Only move to the next band if the earlier one does not apply ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

These are the standard size bands. Being a public authority, a charity or a small occupational pension scheme can affect the result. Use the ICO’s fee check for the rules that apply to your organisation ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

The fee is renewed each year unless registration is no longer needed. Direct debit reduces the amount by £5 ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

**Annual ICO fee before the direct debit reduction**

| Band | Which size test applies? | Annual fee |
| --- | --- | --- |
| Tier 1 | Turnover no more than £632,000 OR no more than 10 staff | £52 |
| Tier 2 | If tier 1 does not apply: turnover no more than £36 million OR no more than 250 staff | £78 |
| Tier 3 | Neither tier 1 nor tier 2 applies | £3,763 |

Source: ICO, Registration FAQs, https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/ (checked 7 October 2026)

## Who is exempt from the ICO fee?

Some uses of personal data are exempt. Examples include using it only for staff administration, your own advertising and marketing, or accounts and records. The word “only” matters. List all the ways your organisation uses personal data before relying on an exemption ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

An exemption from the fee does not remove your other data protection duties. The fee check answers whether you need to pay, rather than whether every part of your use of data meets the law ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

**Check the fee in this order**

1. Check what you do with data: List the uses, rather than just the software you own.
2. Check the exemptions: Find out whether your uses qualify.
3. Find the right band: If a fee is due, check size and any special rules.
4. Keep the other duties: A fee exemption does not remove them.

An exemption and a fee band answer different questions.

Source: ICO, Registration FAQs, https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/ (checked 7 October 2026); ICO, Exemptions, https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ (checked 7 October 2026)

## What should you have ready for the fee check?

Have your annual turnover, staff numbers and a list of how you use personal information. Also note whether you are a public authority, charity or small occupational pension scheme. These are the details behind the ICO’s fee decision ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/) and [ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

## What to do

1. List every purpose for which your organisation uses personal data ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).
2. Check the ICO exemptions before choosing a fee band ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).
3. Use turnover or staff numbers as the band requires, and check any special rules ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).
4. If a fee is due, pay the ICO directly and arrange the annual renewal ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

## Common questions

### Do we need to meet both size limits for tier 1?

No. The test is turnover up to £632,000 or no more than 10 staff ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

### Does direct debit make it cheaper?

Yes. It reduces the fee by £5 ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 7 October 2026).

### Are we free of data protection duties if we are exempt?

No. The exemption concerns the fee. Your other data protection duties still apply ([ICO, Exemptions](https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/), checked 7 October 2026).

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)

## Sources

- ICO, Registration FAQs: https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/ (checked 7 October 2026)
- ICO, Exemptions: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.