We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

ICO has written to you: what to do in the first week

Most letters from the regulator have a clear next step, and a calm first week makes the rest easier.

First, check that the letter is really from the ICO. Then read what it asks for, and by when. The ICO can write about a complaint, the data protection fee, or to ask for information, and its helpline can answer questions.

Checked 7 October 2026

Contents
  1. Why has the ICO written to you?
  2. Is the letter really from the ICO?
  3. The ICO wrote about the data protection fee: what now?
  4. Someone complained to the ICO about you: what now?
  5. What is an ICO information notice, and what must you do?
  6. Who can help when the ICO writes to you?
  7. What to do
  8. Common questions
  9. Sources

Why has the ICO written to you?

The ICO writes to organisations for different reasons. This page covers a complaint, the data protection fee and an information notice.

A person may have complained to the ICO about how you handled their personal information. In most cases, the ICO first asks that person to complain to you.

The letter may be about the data protection fee. The ICO runs regular campaigns to remind small companies of their legal duty to pay it.

The letter may be a formal information notice. Under the UK's Data Protection Act 2018, the regulator, now called the Information Commission, can require a controller or processor to give it information or documents.

If the letter follows a data breach that you reported, read our page on what to do after a breach.

Why the ICO writes

  • A complaint A person complained about how you handled their information In most cases, the ICO asks them to complain to you first
  • The data protection fee A reminder that quotes your Companies House number Pay the fee, or tell the ICO you are exempt
  • An information notice A formal request for information or documents Read what it asks for, and by when
What each kind of letter is about, and the first thing to do.

Is the letter really from the ICO?

A genuine ICO letter about the fee always sends you to pay on the ICO's own website, ico.org.uk. The ICO warns companies about scams linked to the fee.

Some private agencies offer to pay the fee for you. The ICO says they have no official standing and no connection with the ICO, and it recommends that you pay the ICO directly.

To check any letter, the ICO suggests that you search online for the organisation that sent it.

The ICO wrote about the data protection fee: what now?

If the letter quotes your Companies House number, either pay the fee or tell the ICO that you are exempt.

Most companies pay £52 or £78 a year.

An organisation that must pay and does not could be fined up to £4,000. Fines for not paying range from £400 to £4,000.

The ICO publishes a list of the organisations it has given a penalty notice for not paying the fee.

Someone complained to the ICO about you: what now?

If someone complained to the ICO about you, start with your own complaints process. In most cases, the ICO asks the person to complain to you first.

If someone tells you they are complaining to the ICO, you do not need to tell the ICO yourself. The ICO will contact you if it needs more information.

Every organisation must have a process for data protection complaints, and there are no exemptions.

The law sets out what the process must do. Give people a way to complain to you, and acknowledge each complaint within 30 days. Respond without undue delay, make appropriate enquiries, keep the person informed, and tell them the outcome.

What your complaints process must do

  • Give people a way to complain to you
  • Acknowledge each complaint within 30 days
  • Respond without undue delay, and make appropriate enquiries
  • Keep the person informed
  • Tell them the outcome without undue delay
What UK data protection law asks of every organisation, as the ICO sets it out.

What is an ICO information notice, and what must you do?

An information notice is a written notice that requires you to give the regulator information or documents. It must say why the regulator needs them.

The notice may set the time or the period in which you must answer. It must also explain what happens if you do not comply, and your rights of appeal.

In most cases, the notice cannot require an answer before the time to appeal has ended. If the regulator says the matter is urgent and gives its reasons, the deadline still cannot be within 24 hours.

Keep every record the notice covers. Once you have a notice, it is an offence to destroy, hide or falsify that information to stop the regulator seeing it.

The regulator can also cancel a notice in writing.

Read an information notice in this order

  • What information or documents does it ask for?
  • Why does the regulator need them?
  • What deadline or response period does it set?
  • What does it say about appeal rights and non-compliance?
  • Keep the records it covers. Do not destroy, hide or falsify them.
Use the dates and instructions in your own notice. This checklist does not set a replacement deadline.

Who can help when the ICO writes to you?

The ICO itself can help. It runs an advice service for small organisations, with a helpline and live chat from Monday to Friday, 9am to 5pm. The helpline number is 0303 123 1113.

Inside your organisation, start with your data protection officer, if you have one.

Outside help comes from data protection advisers and law firms. For example, Bratby Law lists breach response and ICO notification, KPMG lists breach-response coordination, and Winston Taylor lists regulatory inquiries. We read these on each firm's own website on 19 September 2026.

What to do

  1. Check the letter is genuine. An ICO fee letter always sends you to ico.org.uk to pay.
  2. Find the deadline, if the letter sets one, and put it in the diary.
  3. Keep every record the letter is about. Do not delete or change anything.
  4. If it is about a complaint, follow your own complaints process.
  5. If it is about the fee, pay it or tell the ICO that you are exempt.
  6. If you have questions, call the ICO helpline on 0303 123 1113.

Common questions

The ICO has written to us. Who can help?

The ICO runs a helpline and live chat for small organisations. Your data protection officer, an adviser or a law firm can also help.

Do we have to tell the ICO if someone says they will complain?

No. The ICO says there is no need to tell it. It will contact you if it needs more information.

Is a letter about the data protection fee a scam?

Some are. A genuine ICO letter always sends you to pay on ico.org.uk. Agencies that offer to pay for you have no connection with the ICO.

How much is the fine for not paying the data protection fee?

Fines for not paying range from £400 to £4,000.

Where next

Sources

  1. ICO, How does the ICO deal with complaints?, checked 5 October 2026
  2. legislation.gov.uk, Data Protection Act 2018, section 142, checked 5 October 2026
  3. ICO, Data protection fee: what you need to do, checked 5 October 2026
  4. ICO, How to deal with data protection complaints, checked 5 October 2026
  5. legislation.gov.uk, Data Protection Act 2018, section 148, checked 5 October 2026
  6. ICO, Registration FAQs, checked 5 October 2026
  7. ICO, Penalty notices issued for non-payment of data protection fee, checked 5 October 2026
  8. The Assurance Desk, Bratby Law profile, checked 5 October 2026
  9. The Assurance Desk, KPMG LLP (UK) profile, checked 5 October 2026
  10. The Assurance Desk, Winston Taylor UK LLP (formerly Taylor Wessing) profile, checked 5 October 2026

This is an independent editorial guide, not legal advice.