Usually yes, unless you are exempt. UK law says every business that decides how personal data is used (a "controller") must pay a yearly data protection fee to the ICO, unless all of its use of personal data is exempt. Sole traders count. Most sole traders and small firms pay the tier 1 fee of £52 a year, or £47 by direct debit. The ICO's free fee self-assessment tells you whether you need to pay.
Last updated 2 November 2026. Checked against the ICO's own pages on ico.org.uk.
Not legal advice. This is a plain-English summary of the ICO's own published guidance, checked on 2 November 2026. For advice about your situation, speak to a solicitor or call the ICO's helpline on 0303 123 1113.
DataSorted is not affiliated with the ICO. DataSorted is a waitlist and demand test only: no product is live and no payment is taken.
The ICO says the fee is paid by everyone from sole traders and small businesses to large organisations, unless they are exempt. "Personal data" includes things like customer names, phone numbers, addresses and email addresses.
If you use CCTV for crime prevention, you must pay. The ICO says the answer is always "yes" in that case. A dashcam on a vehicle you use for work counts too: the ICO says you are likely to need to pay unless you are exempt, and you should answer "yes" to the CCTV question in its self-assessment.
| Tier | Who | Yearly fee |
|---|---|---|
| Tier 1 (micro) | Turnover up to £632,000 or no more than 10 staff | £52 (£47 by direct debit) |
| Tier 2 (small and medium) | Turnover up to £36 million or no more than 250 staff | £78 |
| Tier 3 (large) | Everyone else | £3,763 |
Paying by direct debit takes £5 off at the point of payment, so tier 1 is £47. For the fee, "staff" includes employees, workers, office holders and partners, averaged over your financial year, with each part-time person counted as one. The ICO treats everyone as tier 3 until they say otherwise.
You don't need to pay if you use personal data only for one or more of these purposes:
The word "only" matters. If any of your use of personal data falls outside this list (CCTV is the common one), you have to pay. Being exempt from the fee does not exempt you from the rest of data protection law.
If you need to pay and don't, the ICO can fine you up to £4,000 on top of the fee. The ICO says these fines range from £400 to £4,000.
The ICO says some of its guidance is under review after the Data (Use and Access) Act 2025. Since 30 September 2026 the regulator has been the Information Commission. It is still known as the ICO.
Usually yes, unless all of their use of personal data is exempt. The ICO says the fee is paid by everyone from sole traders to large organisations. Its free fee self-assessment on ico.org.uk tells you whether you need to pay.
Most sole traders and small firms are in tier 1 (turnover up to £632,000 or no more than 10 staff), which is £52 a year. Paying by direct debit takes £5 off, so it is £47. Tier 2 is £78 and tier 3 is £3,763.
Yes for CCTV used for crime prevention: the ICO says you must pay. For a dashcam on a vehicle you use for work, the ICO says you are likely to need to pay unless you are exempt.
The ICO can fine you up to £4,000 on top of the fee. It says these fines range from £400 to £4,000.
No. Pay the ICO directly at ico.org.uk. DataSorted is an independent waitlist test, is not affiliated with the ICO, and takes no payments.
Everything above is taken from these ICO pages, checked on 2 November 2026. If anything here differs from the ICO, the ICO is right.
DataSorted is a planned phone-friendly helper for UK tradespeople and small businesses. It is not built yet. If you'd like to hear if it launches, join the free waitlist. It is free, nothing is charged, and you can ask to be removed at any time. Everything on this page can also be done for free using the ICO's own tools.