For practices in the UK

ICO Registration Fee for Private Practices: Do You Need to Pay?

If you run a private practice in the UK and keep client records on a computer, phone or practice software, you almost certainly need to pay the ICO registration fee, officially called the data protection fee. For a sole trader or small clinic it's £52 a year (£47 by direct debit). The exemptions that let some businesses skip it don't cover clinical records, so "I'm too small" or "I only see a few clients" won't get you out of it.

This guide is for private physios, OTs, psychologists, counsellors, podiatrists, dietitians, osteopaths, chiropractors and other clinicians. It explains who has to pay, which tier you're in, how to register and renew, and what else UK GDPR expects of a small practice once you're on the register.

The figures below come from the Data Protection (Charges and Information) Regulations 2018 and the ICO's guidance on the fee, as at November 2026. They can change, so check the ICO's site before you pay.

Do you need to register with the ICO?

The fee is paid by data controllers: the person or organisation that decides why and how personal information is used. If you decide what goes in a client's notes, where they're stored and who sees them, you're a controller.

Every controller must pay unless all of its processing is exempt (more on exemptions below). In practice, the question for clinicians isn't whether the practice pays, but which legal person pays.

Associates, contractors and room renters

This is where most of the confusion sits. Ask yourself:

• Are the clients yours, or the clinic's? Who do they book and pay?
• Whose system holds the notes, and who decides how long they're kept?
• If you left, would you take the records with you?

If the clinic owns the client relationship, runs the booking and notes system, and sets the record-keeping rules, the clinic is likely to be the controller and you may not need your own fee. If you bring your own clients, keep your own notes and invoice them yourself, you're a controller and need to pay, even if you rent a room in someone else's building. Some arrangements make both of you controllers. Write down who is responsible in your associate or room-rental agreement, so it isn't left to guesswork.

The ICO's guidance for the health and social care sector makes the same point: if you conduct private consultations with patients, you may need to pay. If you're unsure, the ICO's fee self-assessment takes a few minutes and tells you whether you need to.

ICO registration fee tiers

There are three tiers. You're in the lowest one you qualify for, and for tiers 1 and 2 you only need to meet one of the two tests (turnover or staff).

Almost every private allied health practice is in tier 1. A clinic with 15 staff but turnover under £632,000 is still tier 1, because meeting either test is enough. Your tier is set by your turnover and staff numbers on the first day of each annual charge period, so check it again at each renewal.

These amounts have applied since 17 February 2025, when the fees rose from £40, £60 and £2,900. Older blog posts and some company-formation sites still quote the old figures.

Exemptions: why most practices can't use them

The regulations exempt a controller only if all of its processing falls into exempt categories. The main ones are:

• Staff administration: payroll and HR records for your own staff, volunteers and contractors
• Advertising, marketing and PR for your own business
• Accounts and records: invoicing, records of sales and purchases, and financial forecasting
• Not-for-profit organisations processing data only to run their membership or support
• Personal, family or household use
• Paper-only records that are never processed on a computer and aren't meant to be

Notice what's missing: providing health care. Clinical notes, assessments, referral letters and treatment plans are health data used to treat people, and none of the exemptions cover that. As soon as you hold client records for treatment, you need to pay.

The paper-only exemption sounds like a way out for practitioners who still write notes by hand, but it rarely works. If you email clients, keep their details in your phone, send text reminders, use online booking or type up letters, you're processing personal data by automated means. CCTV at the clinic also takes you outside the exemptions.

Being exempt from the fee never exempts you from UK GDPR itself. Even an exempt organisation must follow the rest of the law.

How to register and pay the ICO fee

Pay the ICO directly through ico.org.uk. Some company-formation and compliance firms offer "ICO registration" as a paid service, but that usually means the same online form with their fee added on top, and it doesn't give you any extra protection.

1. Check you need to pay with the self-assessment.
2. Gather your details. The ICO needs the controller's legal name and address (your registered office for a company, or your main place of business for a sole trader), a contact, your staff numbers and turnover band, and whether you're a public authority.
3. Complete the online registration and choose your tier.
4. Pay by direct debit or card. Direct debit is £5 cheaper and renews automatically each year.
5. Keep your registration reference. You'll need it to renew, change your details or answer an ICO letter.

When to pay

The law requires a new controller to pay within the first 21 days of becoming one. For a new practice, that's 21 days from when you start holding client information, which is usually before your first appointment, because intake forms and bookings count. Add it to your practice set-up list alongside your professional registration, insurance and business bank account (see our guides to starting a practice).

What appears on the public register

Once you pay, some of your details are published on the ICO's public register of fee payers, which anyone can search. The register shows your name and address. The law asks a sole trader for their principal place of business, so if you mainly work from home, that may be your home address.

Renewing, changing and cancelling your registration

• Renewal is yearly. If you pay by direct debit and your tier hasn't changed, it renews automatically. Otherwise, the ICO sends a reminder before your registration expires, but set your own reminder too.
• Change your tier or details when your staff numbers, turnover, address or business structure change. Moving from sole trader to a limited company creates a new controller. The company needs its own registration, and you should cancel the old one once you stop practising in your own name.
• Cancel if you stop practising or are no longer a controller, for example if you become an employee.

What happens if you don't pay

Failing to pay is a breach of the regulations, and the ICO can issue a fixed penalty on top of the fee you owe. The ICO's published penalty for a tier 1 organisation has been £400, and it can increase penalties for aggravating factors, up to a legal maximum of 150% of the top-tier fee. The ICO also publishes the names of organisations it has issued penalty notices to.

For a small practice, that's an expensive way to skip a £52 bill, and it puts your name on a public list.

The ICO is now the Information Commission

On 30 September 2026, under the Data (Use and Access) Act 2025, the Information Commissioner's Office was replaced by the Information Commission, a body led by a board rather than a single commissioner. It's still known as the ICO, the fee and its tiers haven't changed, and existing registrations carry on.

What else UK GDPR expects of a small practice

Paying the fee puts you on the register. It doesn't make you compliant. Health information is special category data under UK GDPR, so it needs more care than ordinary business records. As a minimum, a private practice should have:

• A lawful basis and a health data condition. You need both: a lawful basis under Article 6 of UK GDPR (for a private practice, often contract or legitimate interests) and a condition for health data under Article 9 (for treatment records, usually the 'health or social care' condition). Consent is rarely the right choice for clinical records. Write down which you rely on.
• A privacy notice telling clients what you collect, why, who you share it with (GPs, insurers, referrers) and how long you keep it. Put it on your website and in your intake paperwork. If you send intake forms online, you can include the notice and capture acknowledgement in the same form, for example with Caspen's online forms.
• A record of your processing. Organisations with fewer than 250 staff are excused from keeping one, but not if they process special category data regularly, which every clinic does.
• Appropriate security. Strong passwords and multi-factor sign-in, encrypted devices, locked filing cabinets, access limited to the people who need it, and backups. Practice software helps here: Caspen's security includes encryption in transit and at rest, role-based permissions, logs of who viewed or changed a client record, automatic session expiry and automated backups.
• Written contracts with processors. Your practice software, cloud storage, email and transcription providers process data for you, so you need a data processing agreement with each one.
• A retention policy. Decide how long you keep records, guided by your professional body and indemnity insurer, and securely destroy them after that.
• A process for subject access requests. Clients can ask for a copy of their records, and you generally have one month to respond.
• A breach plan. If a breach is likely to put people at risk, such as a lost unencrypted laptop or an email sent to the wrong client, you must report it to the ICO within 72 hours of becoming aware of it, and tell the affected clients if the risk is high.
• A data protection complaints process. Since 19 June 2026, controllers must make it easy to complain about how they handle personal data, for example with a complaint form that can be completed electronically. They must also acknowledge each complaint within 30 days and respond without undue delay.

Most small practices don't need a formal data protection officer, but someone, usually the owner, should be clearly responsible for all of the above. If you hold NHS contracts, you may also need to complete the NHS Data Security and Protection Toolkit. Check with the commissioning body.

None of this is legal advice. For your specific set-up, the ICO's advice for small organisations and its helpline are free, and your professional body can help with record-keeping standards.

Quick checklist

• Worked out who the controller is (you, your company or the clinic you work in)
• Paid the ICO data protection fee directly, within 21 days of starting
• Set up direct debit, or a renewal reminder
• Privacy notice on your website and intake forms
• Record of processing, retention policy and processor agreements in place
• Breach, subject access and complaints procedures written down

Keep client records secure from day one

Caspen keeps client records, notes, forms and invoices in one place, with access controls, audit logs and encrypted storage built in. Start your free trial and set up your practice the right way from the start.