The Data Protection (Charges and Information) (Amendment) Regulations 2025

The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) (“the 2018 Regulations”) set out the circumstances in which data controllers are required to pay a charge to the Information Commissioner. Regulation 2 of the 2018 Regulations requires a data controller to pay an annual charge to the Information Commissioner unless all of the processing by the data controller is exempt processing. Each annual period for which a charge must be paid is described as a “charge period”. Regulation 3 of the 2018 Regulations makes provision for the amount of the annual charge, prescribing three tiers of charges according to criteria relating to a data controller’s turnover and number of members of staff (or only members of staff, for a public authority). Charities and small occupational pension schemes are included in the lowest tier. The charge is reduced if a data controller pays the charge by direct debit.