The UK government has opened a consultation on exemptions to paying a data protection fee, giving businesses the opportunity to lobby for new exemptions to be introduced.

Businesses that are responsible for processing personal data (i.e. controllers) are required to pay a data protection fee to the Information Commissioner’s Office (ICO). These fees are: £40 for micro organisations; £60 for small and medium organisations (SMEs); and £2,900 for larger organisations. These fees apply unless the controller is legally exempt.

The government has launched a consultation on whether the list of exemptions should be expanded. As the government is required under the General Data Protection Regulation (GDPR) to ensure the ICO receives an adequate level of funding, it says that it will take into account of the impact of any changes on the ICO’s resources.

Current exemptions

The Data Protection (Charges and Information) Regulations 2018 (the Regulations) require controllers who are processing personal information to pay a charge to the ICO, unless they are exempt. More than 500,000 organisations are currently registered. The Schedule to the Data Protection (Charges and Information) Regulations 2018 provides a number of exemptions for individuals and organisations from paying charges to the Information Commissioner in relation to one or more of the following:

(i) business purposes:

  • Staff administration (including payroll)
  • Advertising, marketing and public relations (in connection with their own business activity)
  • Accounts and records (except in relation to processing of personal data by or obtained from a credit reference agency)

(ii) Other exemptions – processing for the purposes of:

  • Judicial functions
  • Personal, family or household affairs (including recreational purposes)
  • Some not-for-profit organisations
  • Controllers processing personal data only for maintaining a public register (such as the Electoral Roll)
  • Controllers that do not process personal data by automated means, or with the intention that the data will be processed by automated means

(iii) Exemptions granting a reduction in fees (tier 1 fee £40):

  • Small occupational pension schemes
  • Charities


The Department for Digital, Culture, Media and Sport has now asked businesses whether the list of exemptions should be expanded and which exemptions are considered to be appropriate and should be retained and those that aren’t. The deadline for providing responses to the consultation is 1 August 2018.


It will be interesting to see what responses are triggered by this consultation, and what changes will be made as a result. Of course, there is merit in reviewing the exemptions to ensure that they are still current and appropriately apply to businesses that should benefit from them. We will be watching with a close eye.