Do I need to register with the ICO? Almost certainly, and it costs £52

A larger customer sends over a supplier questionnaire, and one of the boxes wants your ICO registration number. Nobody in the office knows whether there is one.

That is how most small firms find out. The answer, more often than not, is that they are registrable and have never registered, and it is almost never deliberate. Somebody decided years ago that the exemption applied, the decision was probably right at the time, and nobody has looked at it since.

The fee is the least interesting part of this

Start with the money, because it is small enough to get out of the way.

£52: Tier 1, micro organisations
£78: Tier 2, most small and medium firms
£400: Fixed penalty for tier 1 non-payment

Which tier you fall into is decided by turnover or headcount, and that "or" does more work than people expect. Tier 1 is a maximum turnover of £632,000 for your financial year or no more than ten members of staff. Either one puts you there. So the eight-person firm turning over two million is a tier 1 payer at £52, which is not what most owners guess when they hear that the band is set by turnover.

Tier 2 runs to £36 million or 250 staff and costs £78. Registered charities pay the tier 1 fee whatever their size.

The penalties for not paying are £400 at tier 1 and £600 at tier 2, and the ICO says it can go higher where a controller will not give it enough information to work out which tier they belong in. So the arithmetic of ignoring this is poor: the fee is £52 and the fine for not paying the fee is roughly eight times that.

Why so many firms are sure they are exempt

The exemptions are real. They are also narrower than the office folklore suggests, and they turn on what you do with personal information rather than on how small you are.

I am not going to tell you whether yours applies, and you should be suspicious of any article that does. The ICO runs two short checkers, one for the exemption and one for the fee, and the exemption one takes about two minutes. Start with those rather than with a blog post.

The mistake worth naming is not misreading the rules. It is deciding once and never revisiting, because the thing the decision depends on has moved. A firm that kept paper records and a phone list in 2019 now has a camera on the yard gate, a mailing list in a marketing tool, a booking system, a dash cam in each van and a CRM somebody set up in a fortnight. None of that arrived as a data protection decision. It arrived as four separate purchases, each of which made sense on its own.

The questions are the actual value

Here is the part nobody mentions, and the reason this is worth a morning rather than ten minutes.

To answer the ICO's checkers honestly, you have to answer questions your business has probably never been asked. Do you operate CCTV. Do you hold staff records. Do you keep a marketing list, and do you send electronic marketing to it. Do you profile anyone. Does somebody else hold personal information on your behalf.

Write the answers down as you go, and you have accidentally produced the first useful draft of where personal information actually lives in your business. That document is the thing of value. A compliance package will sell it back to you for four figures, and the version you produce yourself, in your own words, about your own systems, will be more accurate than the one a questionnaire produces about you.

01Run the ICO's exemption checker, then the fee self-assessment
02Pay it if you owe it, and put the renewal in the diary
03Keep the answers in a document somebody can find next year
04Against each answer, write which system holds that data and who in the firm is responsible for it

The fourth step is the one that changes anything. The first three settle a registration. The fourth turns it into a map.

The two answers that will be uncomfortable

There are usually two, and they are the same two in most firms we look at.

The first is the marketing list. Not whether it exists, but where each name on it came from and whether you could show that if somebody asked. Lists get merged, imported, bought and migrated, and the column recording where a contact came from is the one that most reliably fails to survive the journey. That is a subject of its own and a legal one, so I will leave it there.

The second is quieter and more common: a spreadsheet of customer details on somebody's laptop that no system knows about. It exists because the system was awkward one afternoon three years ago and the spreadsheet was not. It is nobody's fault and it is nobody's responsibility, which is precisely the problem, because the data map you have just drawn does not contain it and nobody would think to mention it.

We build the systems this data sits in, which is why the second one is the one I would go looking for first. Every CRM, client portal and practice platform we have written has a version of it somewhere just outside the edges: the export that became a working file, the list somebody keeps because the report they need does not exist yet. Finding those is more useful than any policy document, and it costs nothing but a conversation with the four people who actually do the work.

What I would actually do

If you have never registered, do the checkers this week. If the answer is that you owe £52, pay it and stop thinking about it.

Then treat the answers as the deliverable rather than the receipt, because the registration is a formality and the map is not. A firm that can say where personal information lives, which system holds it and who is responsible for each one is in a position to answer a customer's questionnaire, a subject access request or a bad Monday morning. A firm with a registration number and nothing behind it can answer only the questionnaire.

None of this is legal advice and I am not a solicitor. It is the observation that the cheapest data audit available to a small business is the one the regulator makes you do anyway, and that most firms throw the answers away.

The first conversation costs nothing, and if the honest answer is that your arrangements are already fine, we will say so.

We work with businesses across Knutsford, Alderley Edge, Wilmslow, Altrincham, Stockport and Warrington, and remotely for clients anywhere in the UK.