# ICO has written to you: what to do in the first week Most letters from the regulator have a clear next step, and a calm first week makes the rest easier. The Assurance Desk. Published 5 October 2026. Last checked 7 October 2026. **The short answer.** First, check that the letter is really from the ICO. Then read what it asks for, and by when. The ICO can write about a complaint, the data protection fee, or to ask for information, and its helpline can answer questions ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), [legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142) and [ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). ## Why has the ICO written to you? The ICO writes to organisations for different reasons. This page covers a complaint, the data protection fee and an information notice. A person may have complained to the ICO about how you handled their personal information. In most cases, the ICO first asks that person to complain to you ([ICO, How does the ICO deal with complaints?](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/), checked 5 October 2026). The letter may be about the data protection fee. The ICO runs regular campaigns to remind small companies of their legal duty to pay it ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). The letter may be a formal information notice. Under the UK's Data Protection Act 2018, the regulator, now called the [Information Commission](/news/ico-becomes-the-information-commission), can require a controller or processor to give it information or documents ([legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142), checked 5 October 2026). If the letter follows a data breach that you reported, read [our page on what to do after a breach](/best/post-breach). **Why the ICO writes** - **A complaint**: A person complained about how you handled their information (In most cases, the ICO asks them to complain to you first) - **The data protection fee**: A reminder that quotes your Companies House number (Pay the fee, or tell the ICO you are exempt) - **An information notice**: A formal request for information or documents (Read what it asks for, and by when) What each kind of letter is about, and the first thing to do. Source: ICO, How does the ICO deal with complaints?, https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/ (checked 5 October 2026); legislation.gov.uk, Data Protection Act 2018, section 142, https://www.legislation.gov.uk/ukpga/2018/12/section/142 (checked 5 October 2026); ICO, Data protection fee: what you need to do, https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/ (checked 5 October 2026) ## Is the letter really from the ICO? A genuine ICO letter about the fee always sends you to pay on the ICO's own website, ico.org.uk. The ICO warns companies about scams linked to the fee ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). Some private agencies offer to pay the fee for you. The ICO says they have no official standing and no connection with the ICO, and it recommends that you pay the ICO directly ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). To check any letter, the ICO suggests that you search online for the organisation that sent it ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). ## The ICO wrote about the data protection fee: what now? If the letter quotes your Companies House number, either pay the fee or tell the ICO that you are exempt ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). Most companies pay £52 or £78 a year ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). An organisation that must pay and does not could be fined up to £4,000. Fines for not paying range from £400 to £4,000 ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). The ICO publishes a list of the organisations it has given a penalty notice for not paying the fee ([ICO, Penalty notices issued for non-payment of data protection fee](https://ico.org.uk/about-the-ico/our-information/penalty-notices-issued-for-non-payment-of-data-protection-fee/), checked 5 October 2026). ## Someone complained to the ICO about you: what now? If someone complained to the ICO about you, start with your own complaints process. In most cases, the ICO asks the person to complain to you first ([ICO, How does the ICO deal with complaints?](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/), checked 5 October 2026). If someone tells you they are complaining to the ICO, you do not need to tell the ICO yourself. The ICO will contact you if it needs more information ([ICO, How does the ICO deal with complaints?](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/), checked 5 October 2026). Every organisation must have a process for data protection complaints, and there are no exemptions ([ICO, How to deal with data protection complaints](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/), checked 5 October 2026). The law sets out what the process must do. Give people a way to complain to you, and acknowledge each complaint within 30 days. Respond without undue delay, make appropriate enquiries, keep the person informed, and tell them the outcome ([ICO, How to deal with data protection complaints](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/), checked 5 October 2026). **What your complaints process must do** - Give people a way to complain to you - Acknowledge each complaint within 30 days - Respond without undue delay, and make appropriate enquiries - Keep the person informed - Tell them the outcome without undue delay What UK data protection law asks of every organisation, as the ICO sets it out. Source: ICO, How to deal with data protection complaints, https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ (checked 5 October 2026) ## What is an ICO information notice, and what must you do? An information notice is a written notice that requires you to give the regulator information or documents. It must say why the regulator needs them ([legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142), checked 5 October 2026). The notice may set the time or the period in which you must answer. It must also explain what happens if you do not comply, and your rights of appeal ([legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142), checked 5 October 2026). In most cases, the notice cannot require an answer before the time to appeal has ended. If the regulator says the matter is urgent and gives its reasons, the deadline still cannot be within 24 hours ([legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142), checked 5 October 2026). Keep every record the notice covers. Once you have a notice, it is an offence to destroy, hide or falsify that information to stop the regulator seeing it ([legislation.gov.uk, Data Protection Act 2018, section 148](https://www.legislation.gov.uk/ukpga/2018/12/section/148), checked 5 October 2026). The regulator can also cancel a notice in writing ([legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142), checked 5 October 2026). **Read an information notice in this order** - What information or documents does it ask for? - Why does the regulator need them? - What deadline or response period does it set? - What does it say about appeal rights and non-compliance? - Keep the records it covers. Do not destroy, hide or falsify them. Use the dates and instructions in your own notice. This checklist does not set a replacement deadline. Source: legislation.gov.uk, Data Protection Act 2018, section 142, https://www.legislation.gov.uk/ukpga/2018/12/section/142 (checked 5 October 2026); legislation.gov.uk, Data Protection Act 2018, section 148, https://www.legislation.gov.uk/ukpga/2018/12/section/148 (checked 5 October 2026) ## Who can help when the ICO writes to you? The ICO itself can help. It runs an advice service for small organisations, with a helpline and live chat from Monday to Friday, 9am to 5pm. The helpline number is 0303 123 1113 ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). Inside your organisation, start with your data protection officer, if you have one. Outside help comes from data protection advisers and law firms. For example, Bratby Law lists breach response and ICO notification, KPMG lists breach-response coordination, and Winston Taylor lists regulatory inquiries. We read these on each firm's own website on 19 September 2026 ([The Assurance Desk, Bratby Law profile](https://theassurancedesk.com/advisers/bratby-law), [The Assurance Desk, KPMG LLP (UK) profile](https://theassurancedesk.com/advisers/kpmg-llp-uk) and [The Assurance Desk, Winston Taylor UK LLP (formerly Taylor Wessing) profile](https://theassurancedesk.com/advisers/winston-taylor-uk), checked 5 October 2026). ## What to do 1. Check the letter is genuine. An ICO fee letter always sends you to ico.org.uk to pay ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). 2. Find the deadline, if the letter sets one, and put it in the diary ([legislation.gov.uk, Data Protection Act 2018, section 142](https://www.legislation.gov.uk/ukpga/2018/12/section/142), checked 5 October 2026). 3. Keep every record the letter is about. Do not delete or change anything ([legislation.gov.uk, Data Protection Act 2018, section 148](https://www.legislation.gov.uk/ukpga/2018/12/section/148), checked 5 October 2026). 4. If it is about a complaint, follow your own complaints process ([ICO, How does the ICO deal with complaints?](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/) and [ICO, How to deal with data protection complaints](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/), checked 5 October 2026). 5. If it is about the fee, pay it or tell the ICO that you are exempt ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). 6. If you have questions, call the ICO helpline on 0303 123 1113 ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). ## Common questions ### The ICO has written to us. Who can help? The ICO runs a helpline and live chat for small organisations. Your data protection officer, an adviser or a law firm can also help ([ICO, Data protection fee: what you need to do](https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/), checked 5 October 2026). ### Do we have to tell the ICO if someone says they will complain? No. The ICO says there is no need to tell it. It will contact you if it needs more information ([ICO, How does the ICO deal with complaints?](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/), checked 5 October 2026). ### Is a letter about the data protection fee a scam? Some are. A genuine ICO letter always sends you to pay on ico.org.uk. Agencies that offer to pay for you have no connection with the ICO ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). ### How much is the fine for not paying the data protection fee? Fines for not paying range from £400 to £4,000 ([ICO, Registration FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), checked 5 October 2026). ## Where next - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md) - [How much can the ICO fine you under UK GDPR?](https://theassurancedesk.com/guides/uk-gdpr-fines.md) - [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md) ## Sources - ICO, Registration FAQs: https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/ (checked 5 October 2026) - legislation.gov.uk, Data Protection Act 2018, section 142: https://www.legislation.gov.uk/ukpga/2018/12/section/142 (checked 5 October 2026) - ICO, Data protection fee: what you need to do: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/ (checked 5 October 2026) - ICO, How does the ICO deal with complaints?: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/how-does-the-ico-deal-with-complaints/ (checked 5 October 2026) - ICO, Penalty notices issued for non-payment of data protection fee: https://ico.org.uk/about-the-ico/our-information/penalty-notices-issued-for-non-payment-of-data-protection-fee/ (checked 5 October 2026) - ICO, How to deal with data protection complaints: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ (checked 5 October 2026) - legislation.gov.uk, Data Protection Act 2018, section 148: https://www.legislation.gov.uk/ukpga/2018/12/section/148 (checked 5 October 2026) - The Assurance Desk, Bratby Law profile: https://theassurancedesk.com/advisers/bratby-law (checked 5 October 2026) - The Assurance Desk, KPMG LLP (UK) profile: https://theassurancedesk.com/advisers/kpmg-llp-uk (checked 5 October 2026) - The Assurance Desk, Winston Taylor UK LLP (formerly Taylor Wessing) profile: https://theassurancedesk.com/advisers/winston-taylor-uk (checked 5 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.