Do we have to pay the ICO fee? Aren't charities exempt?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle. Data protection is reserved: UK GDPR, the DPA 2018, PECR and the ICO apply identically. Northern Ireland: the same position, for the same reason.

Two different rules, and neither one means “charities are exempt”

Charity status caps the ICO data protection fee. It never removes it. “We’re a charity, so we’re exempt” is wrong twice over. Two separate rules mention charities, and the sector runs them together. They are the same in England and Wales, Scotland and Northern Ireland. The treasurer or manager who registers needs to keep them apart, and needs the charity’s data map to hand: if you have not built it, map what personal data you hold and why first.

• The charity rule is a cap. It fixes a charity’s fee at the lowest tier, whatever its size. It does not excuse payment.
• The exemption is a purpose test. It excuses payment entirely. But it is open to any organisation, charity or not. It turns on what you use personal data for, not on your legal form.

The exemption is all or nothing

This is the rule everyone misses. The Data Protection (Charges and Information) Regulations 2018, reg. 2(1), verbatim:

A data controller must comply with the requirements of this regulation unless all of the processing of personal data they undertake is exempt processing.

“All” is the word that matters. If even one thing you do falls outside the exempt purposes, the exemption is gone for the whole charity. You then pay for everything.

The example is CCTV, because most charities have a camera somewhere. The ICO answers the question itself, verbatim: “I have CCTV on my business premises for crime prevention reasons – do I need to pay a fee? Yes.” CCTV is in no exempt category. One camera over the door ends the exemption.

What counts as exempt processing

The exempt purposes are narrow. They are:

• processing that is not automated, such as paper records only
• personal, family or household affairs
• keeping a public register
• staff and volunteer administration
• advertising, marketing and public relations for your own activities
• accounts and records
• not-for-profit purposes — membership or support of the body, or activities for members or people in regular contact with it
• judicial functions

The not-for-profit purpose sounds like the charity one. It is not a blanket cover. On the ICO’s own checklist, a charity loses the not-for-profit exemption entirely if it:

• runs CCTV
• provides services outside its stated aims
• trades or shares personal data

Four common cases: who pays

The four cases in this section show how the test plays out. Only the first row is the ICO’s own answer. The other three are this guide’s reading of the exempt purposes, not ICO rulings. For a binding answer on your own facts, use the ICO’s fee self-assessment tool on its website.

Most charities hold donor, beneficiary and staff data together. So most pay.

What the ICO data protection fee costs

A charity pays the lowest of three tiers, provided it tells the ICO it is a charity. The ICO data protection fee is the annual charge a data controller pays the Information Commissioner’s Office unless all its processing is exempt. It is set by the 2018 Regulations, as amended by SI 2025/63, in force since 17 February 2025. The fee has three tiers:

• Tier 1: £52 a year.
• Tier 2: £78 a year.
• Tier 3: £3,763 a year.

Paying by direct debit takes £5 off.

A charity is in tier 1 whatever its turnover or staff numbers. But tier 3 is the default. The ICO charges tier 3 unless you tell it you qualify for a lower tier.

So when you register, you must say you are a charity. Paying the wrong tier is itself unlawful.

Two official sources still show the old fee

Two official sources still print the fee as it was before it went up on 17 February 2025.

• The ICO’s own FAQ for the “other service activities” sector still shows the pre-2025 charity fee.
• legislation.gov.uk shows the 2018 Regulations “as made” by default. That version still has the old figures for all three tiers. You only see the current ones by choosing “Latest available (Revised)”.

This guide cites the ICO’s fee guide and the amending SI 2025/63. The two agree. If a template or training slide gives you a lower figure, it has probably been copied from one of the stale pages.

Pay, or write the assessment down

You can finish this step in one of two ways.

1. Register and pay, telling the ICO you are a charity. Keep the confirmation.
2. Or, if every activity on your data map is exempt, write a short, dated note saying so. Go through each activity against the exempt purposes. Confirm the answer with the ICO’s self-assessment tool, and file the note.

Revisit the note whenever the data map changes. A new camera, a new service or a new data-sharing arrangement can end the exemption overnight.

The fee is a separate duty from having a written policy. Whether the trustees need to adopt a data protection policy is a governance question, and paying the fee does not answer it.

Next: What must our privacy notice say?

Common mistake: “we’re a charity, so we’re exempt”

The sector mixes up two rules because both mention charities. The charity rule is a cap — it fixes the fee at tier 1 and does not excuse payment. The real exemption is a purpose test open to any organisation. It has nothing to do with legal form.

Common mistake: claiming the exemption for the parts that fit and paying nothing

Nobody reads reg. 2(1), and the exempt purposes look generous. But the test is all-or-nothing. One activity outside them — a single CCTV camera — ends the exemption for the whole organisation. The ICO’s own answer on CCTV is “Yes”, you pay.

Common mistake: quoting the old charity fee

Both the ICO’s “other service activities” FAQ and the “as made” text of the 2018 Regulations still show the pre-2025 figure. The current figures appear only in the ICO’s fee guide, in SI 2025/63 and in the “Latest available (Revised)” view. Publishing the old figure understates the fee.

Common mistake: not telling the ICO you are a charity

The registration form gets filled in as if for any business. But the top tier is the default unless you tell the ICO otherwise. The charity cap applies only when you claim it, and paying the wrong tier is itself unlawful.

Worked example

Wrenfield Village Hall keeps a hirers’ booking list and a committee contact list. It has one CCTV camera over the entrance.

The committee goes through its activities one by one. The bookings and the committee list may fall within the not-for-profit or own-marketing purposes. But CCTV is in no exempt purpose. The ICO’s own answer is that a charity with CCTV pays. So the camera ends the exemption for everything.

Wrenfield registers, tells the ICO it is a charity, and pays the tier 1 fee of £52. Only the CCTV answer here is a direct ICO ruling. The reading of the other activities is this guide’s.

If the committee later removes the camera, it can look again. It would check every remaining activity against the exempt purposes. It would confirm the answer with the ICO’s self-assessment tool and keep a dated note on file.