The Department for Science, Innovation and Technology (DSIT) recently launched a consultation on a proposal to increase the annual data protection fees payable by Data Controllers to the Information Commissioner’s Office (ICO). This follows a statutory review in 2023 of the Charges Regulations 2018, mandated by section 138(3)(a) of the Data Protection Act 2018. The review found that the current fee levels are no longer sufficient to cover the ICO’s operational costs. 

The proposed increase of 37.2%, distributed evenly across the tiers, aims to ensure that the ICO has the necessary funding to carry out its statutory duties effectively and provide support to data controllers. Here is a breakdown of the proposed changes: 

• Tier 1 – Micro organisations with maximum turnover of £632,000 or no more than 10 members of staff: Increase by £15, from £40 to £55 

• Tier 2 – Small and medium organisations with maximum turnover of £36 million or no more than 250 members of staff: Increase by £22, from £60 to £82 

• Tier 3 – Large organisations which do not meet criteria for tier 1 or 2: Increase by £1,079, from £2,900 to £3,979 

The DSIT has confirmed that there will be no changes to the tiering structure, exemptions, or direct debit discounts. 

The aim of these proposals is to secure the resources needed for the ICO to provide guidance, advice, and support to organisations for compliance with data protection obligations. This is also in line with HM Treasury’s principles on Managing Public Money, ensuring full cost recovery. The ICO’s response to the consultation can be read here. Nobody will be surprised to learn that it is in favour of the fee increase. 

The consultation is open until 26 September 2024. 

Enjoy reading our blog? Help us reach 10,000 subscribers by subscribing today!   

This and other data protection developments will be discussed in detail on our forthcoming  GDPR Update  workshop.