GDPR

GENERAL DATA PROTECTION REGULATION (GDPR)

The new data protection fee replaces the requirement to ‘notify’ (or register), which was in the Data Protection Act 1998 (the 1998 Act).

Although the 2018 Regulations come into effect on 25 May 2018, this doesn’t mean everyone now has to pay the new fee. Controllers who have a current registration (or notification) under the 1998 Act do not have to pay the new fee until that registration has expired.”

Have you paid the annual data protection charge?

It is a legal requirement to pay the charge, and failure to do so could result in a fine, but it does also make good business sense as it could have an impact on your organisation’s reputation. Once you have paid, your organisation’s details are published on the Information Commissioner’s register of data controllers.

There are three levels of charge payable:

1. Micro organisations (including sole traders) pay £40;
2. Small and medium organisations pay £60; and
3. Large organisations pay £2,900. Payments made by direct debit will automatically receive an annual £5 deduction.

The ICO have provided a very helpful, easy-to-use online tool to help you determine if payment is necessary; you can find the self-assessment tool on the ICO website. It is also important to make sure you are paying the correct level of charge - the charge-assessment tool will indicate the level you are required to pay.

If you are a data controller and do not pay the charge, or you pay the incorrect charge when required to do so, then you risk enforcement action by the ICO. The maximum fine is £4,350. Don’t get caught out!