The ICO fee: the £52 compliance job most therapists forget

Of everything on a private practitioner's compliance list, this is the cheapest, the quickest, and the one most often missed entirely.

If you hold client records (names, contact details, session notes, anything that identifies a person) you are almost certainly required to pay an annual data protection fee to the Information Commissioner's Office. For a solo practice it costs £52 a year, or £47 if you pay by Direct Debit, and the online form takes about fifteen minutes.

That's the whole job. The rest of this piece is about why it matters more than the fee suggests.

"Registration" is the wrong word

You'll hear therapists talk about "registering with the ICO", and the terminology causes real confusion.

Since the Data Protection Act 2018, there is no register you join in the old sense. What the law requires is that data controllers pay a data protection fee unless they're exempt. The ICO keeps a public list of fee payers, which looks like a register and is where the old language comes from, but the obligation is the payment, not an application you can be turned down for.

This matters practically, because people delay it imagining some approval process with a waiting period. There isn't one. You fill in a form, you pay, you're done.

Which fee tier applies to you

There are three tiers. Solo and small practices land firmly in the first:

| Tier | Who | Fee | By Direct Debit | |---|---|---|---| | Tier 1 | Turnover up to £632,000, or no more than 10 staff | £52 | £47 | | Tier 2 | Larger organisations | £78 | £73 | | Tier 3 | Large organisations | £3,763 | £3,758 |

A solo therapist, or a small group practice with a handful of associates, is Tier 1. There is essentially no realistic private-practice scenario where you're paying more than £52 unless you've grown into something quite different.

Non-payment carries a fixed penalty. Given the amount involved, that's an unusually poor trade.

Are you exempt?

Some very limited processing is exempt from the fee. In practice, holding clinical records about identifiable clients is not the kind of activity that tends to fall inside those exemptions, because you're processing personal data, including health data, for a business purpose.

There are edge cases, and if you genuinely think you might be exempt, the ICO publishes a self-assessment tool that walks you through it, and your professional body will have guidance. But the default assumption for a working private practice should be that the fee applies to you.

The bit that actually matters: you are the controller

Paying £52 is administration. Understanding why you're the one paying it is the part that shapes how you run your practice.

Under UK GDPR, the data controller is whoever decides why and how personal data is processed. In private practice, that's you. You decide who your clients are, what notes you keep, how long you keep them, and who you'd share them with. The responsibility for those decisions sits with you and cannot be outsourced.

The software you use (booking systems, note-taking tools, video platforms, ours included) acts as a data processor. A processor acts on the controller's documented instructions. It carries real obligations under Article 28, but it is not the decision-maker.

That split has three consequences worth internalising:

No software can make you compliant. Be wary of any tool that markets itself as "fully GDPR compliant, so you don't have to worry". A processor can be well-built, properly contracted and appropriately secured, and that helps you enormously, but your lawful basis, your retention decisions, your responses to a client asking for their records: those remain yours. Any vendor implying otherwise is either being careless with language or misunderstanding the regulation.

You need a processor agreement with your suppliers. Article 28 requires a written contract between controller and processor. Any serious practice-management provider will have a data processing agreement available; if you can't find one, ask, and treat difficulty getting a straight answer as information.

Subject access requests come to you. If a client asks for a copy of their data, that's your obligation to answer, generally within one month. Your software should make it easy to find and export what you hold, but the duty to respond is yours.

The related jobs worth doing at the same time

If you're sitting down to do the ICO fee, these belong in the same session:

• A privacy notice telling clients what you hold, why, on what lawful basis, how long you keep it, and who you share it with. Your professional body may have a template.
• A retention position: how long you keep records after therapy ends, and why. Your professional body's guidance and your insurer's requirements both bear on this, and they don't always land in the same place.
• A list of your processors. Who actually touches client data? Your practice software, your email provider, your video platform, possibly your accountant. You should be able to name them.
• Somewhere safe to keep it all. A folder with your privacy notice, retention position, processor list and DPAs. If anything ever goes wrong, having thought about this in advance is worth more than any single document.

A note on where records live

One question that comes up constantly, and deserves a straight answer: it's reasonable to ask a supplier where your client data is physically stored, and who else it's shared with.

UK GDPR doesn't forbid data leaving the UK, and plenty of entirely lawful services rely on transfers under appropriate safeguards. But you're entitled to know, because you're the one who has to explain it in your privacy notice. Any provider should be able to tell you where data is hosted and which sub-processors they use, without you having to chase.

We publish ours on our security page, including the uncomfortable parts.

In short

Pay the £52. It takes a quarter of an hour and closes the easiest gap on your compliance list.

Then spend the more valuable hour on the thing the fee is a proxy for: being clear that the client records in your practice are yours to steward, that your suppliers work to your instructions rather than the other way round, and that you could explain both to a client who asked.

This article is general information about UK data protection requirements as they stood in August 2026, not legal advice. Fees and rules change. Check the current position at ico.org.uk and take guidance from your professional body and, where a question turns on your own circumstances, from a solicitor.

Faresay acts as a data processor for the therapists who use it. Read how we handle data.