New structure for data protection charges introduced

Implementation date: 25 May 2018

The Data Protection (Charges and Information) Regulations 2018 (SI 2018/480) introduce a new charging structure for the fees that data controllers must pay to the Information Commissioner (ICO). The new charging structure is being introduced to coincide with the General Data Protection Regulation (GDPR), which comes into effect on the same date. Data controllers that are not exempt have to pay an annual fee to the ICO and provide certain prescribed information for the fee to be determined. There are three tiers based on employee numbers and annual turnover: £40, £60 and £2,900.

The Regulations provide for exceptions for public authorities, charities and small occupational pension schemes, and an exemption from the charge exists in certain circumstances.

The ICO has published a Guide to the data protection fee.