Guide
The ICO data protection fee: a guide for UK therapists
Who has to pay, which tier a private practice falls into, how renewal works and what happens if you miss it, with links to the ICO and the legislation.
Updated 19 October 2026.
Information, not legal advice. This page is a practical overview for practices. It is not a substitute for advice on your own contracts, insurance or registration.
If you see clients privately in the UK and keep anything about them on a computer, phone or in practice software, you need to know about the data protection fee. The regulator's FAQ puts the rule simply: "If you are a controller and the exemptions don't apply to you, you will have to pay the fee." This guide sets out who pays, which tier applies, how renewal works and what happens if you miss it, using the ICO's own guidance and the Data Protection (Charges and Information) Regulations 2018, so you can check each point yourself.
Sources were read on 19 October 2026. This is information, not legal advice. Fees and guidance change, so check the ICO's pages before you pay.
First, a note on the regulator's name
On 30 September 2026 the Information Commission took over the functions of the Information Commissioner, under section 119 of the Data (Use and Access) Act 2025. The government's announcement says the transition "does not change the regulator's role, responsibilities, or powers", and the ICO says it will continue to be known as the ICO, now as the Information Commission's Office. The 2018 Regulations now refer to the Information Commission, and the fee works as before. We use "the ICO" on this page.
Do you have to pay?
GOV.UK says you must pay a data protection fee "if you're a business, organisation or sole trader processing personal data, unless you're exempt". If you run your own practice, you are usually the controller for your clients' records; our guide to GDPR and therapy notes explains what that means.
Regulation 2 of the 2018 Regulations sets the duty. Within the first 21 days of each charge period, a controller must pay the charge and tell the regulator its name and address, its staff band, its turnover band and whether it is a public authority. A charge period is 12 months. If you became a controller on or after 25 May 2018, your first period starts on the date you became one.
The exemptions
The Schedule to the Regulations lists exempt processing. The items a small practice usually asks about are:
| Exempt processing | Schedule paragraph |
|---|---|
| Personal data that is not processed by automated means, or recorded with the intention that it will be | 2(2)(a) |
| Your personal, family or household affairs | 2(2)(b) |
| Administration of your own staff, volunteers and contractors | 2(2)(d) |
| Advertising, marketing and public relations for your own business | 2(2)(e) |
| Keeping accounts or records of purchases and sales, deciding whether to accept a customer or supplier, and financial forecasts | 2(2)(f) |
| Membership and support processing by a not-for-profit body | 2(2)(g) |
On a plain reading, none of these covers keeping client records for therapy. The paper-only exemption in 2(2)(a) applies only where the personal data is not processed by automated means at all. Client details held in email, a diary app, a spreadsheet or practice software are processed by automated means. The ICO's fee self-assessment tells you whether you need to pay and how much. The ICO says it takes about 10 minutes.
Which tier applies
Regulation 3, as amended from 17 February 2025, sets three tiers. The ICO's guide to the data protection fee gives the same figures.
| Tier | Who it covers | Annual fee |
|---|---|---|
| Tier 1: micro organisations | Turnover of £632,000 or less, or no more than 10 members of staff. Charities and small occupational pension schemes also pay tier 1 | £52 |
| Tier 2: small and medium organisations | Not tier 1, and turnover of £36 million or less, or no more than 250 members of staff | £78 |
| Tier 3: large organisations | Everyone else | £3,763 |
Paying by direct debit takes £5 off the fee (regulation 3(5)). The ICO treats every controller as tier 3 "unless and until they tell us otherwise", so give your staff and turnover details when you register.
Because each test reads "or", a practice meets tier 1 if it is under either the turnover limit or the staff limit. For the staff count, the ICO defines members of staff broadly: employees, workers, office holders and partners. You use the average across your financial year, and each part-time member of staff counts as one.
Registering, renewing and the public register
- Register and pay through the ICO service linked from the GOV.UK page. The ICO helpline is 0303 123 1113.
- Cover runs for 12 months. The ICO's fee FAQs say the fee covers 12 months from the renewal date, not the payment date, and that you are not treated as covered until the ICO receives a payment it can attribute to you. You pay every 12 months, and the ICO contacts you before your payment expires.
- No VAT. The fee is a statutory fee, so no VAT is charged. Refunds are given only in exceptional circumstances.
- Your details are public. Your organisation's name and address appear on the data protection public register. GOV.UK says that if you run your business from home and don't want your home address on the register, you can give a PO box or another address instead. Many therapists work from home, so check this before you submit.
If you don't pay
The ICO's penalties page says you are breaking the law if you process personal data for a non-exempt purpose and have not paid a fee, or have not paid the correct fee. Its FAQs describe the process. You get a reminder first. If you neither pay nor explain why you no longer need to, the ICO can issue a notice of intent 28 days after expiry, and you then have 28 days to pay or make representations.
The ICO's published fixed penalties for failing to pay are £400 for tier 1, £600 for tier 2 and £4,000 for tier 3. It can raise a penalty to the statutory maximum of £4,350 where there are aggravating factors, such as failing to engage with it.
What the fee does not cover
Paying the fee is not the same as complying with UK GDPR. Client notes contain health data, which is special category data, and the usual duties still apply:
- A lawful basis and a separate condition. For special category data you need an Article 6 lawful basis and a separate Article 9 condition, decided before you start and documented. See the ICO's guidance on special category data.
- A record of your processing. Organisations with fewer than 250 employees still have to document processing that is not occasional or that involves special category data. See the ICO's guidance on who needs to document their processing. Regular client work meets both tests.
- A DPIA where processing is likely to be high risk. The same special category guidance says you need a data protection impact assessment for any processing likely to be high risk. This matters if you are thinking about recording sessions or using AI to draft notes. Our recording consent checklist covers the consent side.
- Breach reporting. A notifiable personal data breach must be reported to the ICO without undue delay and no later than 72 hours after you become aware of it. You must also keep a record of every breach, whether or not you report it. See the ICO's guide to personal data breaches.
For hosting questions, read EU hosting and UK GDPR. For retention, read how long to keep therapy records.
A quick checklist
- Take the ICO fee self-assessment
- Work out your tier from your turnover and average staff numbers
- Register and pay within 21 days of becoming a controller, then every 12 months
- Consider paying by direct debit (£5 off)
- Give a PO box or business address if you don't want your home address on the public register
- Note your renewal date
- Document your lawful basis, your Article 9 condition and your record of processing
- Keep a breach log, and know the 72-hour reporting rule
Where software helps, and where it does not
Software can't pay your fee or choose your lawful basis for you. It can make the records behind your answers easier to keep.
In Reach + Within, every user has their own login. Practice assistant, admin and accounts roles can't open clinical notes, and an audit trail nobody can edit or delete shows who viewed or changed what, and when. Client data is hosted in the EU (Netherlands); see security and hosting. Reach also has a data protection impact assessment (DPIA) template that you can download from its privacy settings and complete for your own practice. It is a starting point, not a finished assessment.
To see how this fits a UK practice, read about practice management software for therapists or counselling software.
Sources
- ICO, Guide to the data protection fee
- ICO, Data protection fee: frequently asked questions
- ICO, Data protection fee self-assessment
- ICO, Penalties and Fixed penalties for failure to pay the data protection charge
- GOV.UK, Pay the data protection fee
- legislation.gov.uk, The Data Protection (Charges and Information) Regulations 2018: regulation 2, regulation 3 and the Schedule
- legislation.gov.uk, Data (Use and Access) Act 2025, section 119
- GOV.UK, Information Commission succeeds the ICO as UK's data protection regulator, 30 September 2026
- ICO, ICO governance changes confirmed for 30 September 2026
- ICO, Special category data, Who needs to document their processing activities? and Personal data breaches: a guide
Related reading
Questions
Is this legal advice?
No. It is information for practices. It is not a substitute for advice on your contracts, insurance or registration.
Are the examples about real clients?
No. Any example in a guide is fictional. Names, ages and details are invented, and no client record was used.
Does the guide apply a retention period for me?
No. Where a source gives a period, the retention guide quotes it. Other guides do not invent a number of years.
Join the waitlist.
Reach + Within is in private development. Join the waitlist and we will email you when it opens.