Do I need to register with the ICO? (A question many small businesses don't realise they should be asking.)
There's one question we've found ourselves asking a surprising number of new clients recently: “Are you registered with the ICO?”
And quite often, the answer has been: “Should I be?”
It's one of those small business responsibilities that can easily be missed. When you set up your business, you get your website live, start working with clients, perhaps build a mailing list or take on your first employee, but nobody necessarily gives you a checklist of all the other things you need to consider along the way.
What is the ICO and what does registering with them actually mean?
The Information Commissioner’s Office is the regulator of data protection and other information rights legislation. Under the Data Protection (Charges and Information) Regulations 2018, organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt.
If your business or organisation processes personal information (like customer names, email addresses, staff payroll, or CCTV footage), you may be required by law to pay the ICO data protection fee unless a specific exemption applies.
The ICO adds your organisation's name to a public register of fee payers, showing that you are on record and transparent about data handling.
Does my small business need to register with the ICO?
Your small business may need to register and pay an annual data protection fee if it processes personal data on computers or other electronic devices.
The word ‘processing’ can make this sound more technical than it really is. In simple terms, if your business collects, stores, uses, shares or deletes information that can identify a person, you are processing personal information. This could be as simple as keeping a customer's name, email address and phone number in your contacts, maintaining a client spreadsheet, holding employee records, using a mailing list or storing customer details in your accounting software. Most businesses will process personal information in some form as part of their day to day activities.
But, processing personal information doesn't automatically mean you need to pay the ICO data protection fee, because exemptions can apply.
Are any businesses exempt?
There are some exemptions from paying the ICO data protection fee. For example, you may not need to pay if the only personal information you process is for certain purposes such as staff administration, your own accounts and records, or advertising and marketing your own business.
However, whether an exemption applies depends on what personal information you process and, importantly, what you use it for. Being a small business or sole trader does not automatically make you exempt.
How do I check whether I need to register?
Luckily, this isn't something you need to work out yourself. The ICO has a short online self assessment which takes you through a series of questions about your business and how you use personal information. It will tell you whether you need to pay the data protection fee and, if so, how much.
How much does ICO registration cost?
This depends on the answers you provide in the survey on the ICO website. There are three different tiers of fee and the tier your business falls into depends on:
how many members of staff you have
your annual turnover
whether you are a public authority
whether you are a charity
whether you are a small occupational pension scheme
Most small businesses we work with fall into Tier 1 or 2.
Tier 1 - micro organisations
You have a maximum turnover of £632,000 for your financial year or no more than 10 members of staff. The fee for tier 1 is £52.
Tier 2 - small and medium organisations
You have a maximum turnover of £36 million for your financial year or no more than 250 members of staff. The fee for tier 2 is £78.
Top Tip: If you pay your fee annually by direct debit, they offer a £5 discount each year on your fee. Reducing tier 1 from £52 to £47 and tier 2 from £78 to £73.
FAQs about registering with the ICO
What happens if I should have registered but haven't?
If you are required to pay the fee and don't do so, the ICO can issue a fine of up to £4,350. If you've realised that you should have registered, the important thing is not to ignore it. Use the ICO self assessment and, if required, register and pay the fee as soon as possible.
Is registering with the ICO the same as being GDPR compliant?
This is a common misconception. No, registering with the ICO is not the same as being GDPR compliant. GDPR compliance is about your internal processes and how you collect, use, store, share and protect people's personal information. It includes making sure you have a lawful reason for using personal data, only keeping the information you need for as long as necessary, keeping it secure, being transparent about how you use it and having processes in place to respond when someone exercises their data protection rights. Registering with the ICO, where required, is just one part of your wider data protection responsibilities.
Not sure what else might have slipped through the cracks?
ICO registration is just one of those business responsibilities that's easy to miss when you're busy running your business.
At By Your Side, we help small business owners put the right admin, processes and practical support in place, from bookkeeping and day to day admin to policies, procedures and operational support.
If you're spending too much time trying to keep on top of everything yourself, book a discovery call to find out how we can help.
Further reading:
15 things all small businesses need to know about data protection - ICO
