How much is the ICO data protection fee for a small therapy practice?

Since 17 February 2025, the tier 1 fee for micro organisations — a maximum turnover of £632,000 or no more than 10 members of staff — is £52 a year. Tier 2 (small and medium organisations) is £78 and tier 3 (large organisations) is £3,763. Most solo and small therapy practices fall into tier 1.

How do I check whether I need to pay the ICO fee?

The ICO provides a free online self-assessment that takes a few minutes and tells you whether you need to pay and which tier applies. It is available on ico.org.uk under the data protection fee section.

What happens if a therapist does not pay the fee?

The ICO can issue a monetary penalty for failing to pay the required fee, in addition to the unpaid fee itself. Paying the fee is a legal requirement under the Data Protection (Charges and Information) Regulations 2018, separate from your wider UK GDPR obligations.

Home › Guides › ICO data protection fee

Compliance guide

Do private therapists need to pay the ICO data protection fee?

Q: Does a self-employed therapist count as a data controller?

Yes, in almost all cases. A therapist in private practice decides why and how client information is processed, which makes them a data controller under UK data protection law. Data controllers processing personal data electronically must pay the annual data protection fee unless every part of their processing is exempt.

By the Caseload team · Published 24 July 2026 · For therapists, counsellors and psychologists in UK private practice

Yes — almost every UK therapist in private practice must pay the ICO data protection fee. If you keep client information electronically, you are a data controller and the annual fee applies unless an exemption covers all of your processing. For most solo practices the tier 1 fee is £52 a year, as set from 17 February 2025.

Why the fee applies to therapists

Under the Data Protection (Charges and Information) Regulations 2018, every data controller who processes personal data must pay an annual charge to the Information Commissioner unless all of their processing is exempt [1]. A therapist in private practice decides what client data is collected and how it is used — session notes, contact details, appointment history, invoices — which makes the practitioner (or their company) the data controller.

The ICO's guide to the data protection fee explains who must pay and sets out the exemptions; the exemptions are narrow, and processing client health data electronically as part of running a practice will generally not be covered by them [2]. The reliable way to confirm your own position is the ICO's free online self-assessment [2].

How much it costs

Fee amounts were increased by the Data Protection (Charges and Information) (Amendment) Regulations 2025, which came into force on 17 February 2025 [1]:

Tier	Who it covers	Annual fee (from 17 Feb 2025)
Tier 1 — micro organisations	Maximum turnover of £632,000 or no more than 10 members of staff	£52 (previously £40)
Tier 2 — small and medium organisations	Maximum turnover of £36 million or no more than 250 members of staff	£78 (previously £60)
Tier 3 — large organisations	All other data controllers	£3,763 (previously £2,900)

A solo therapist or a small group practice will almost always fall into tier 1. The ICO also offers a direct debit discount — check the current amount on the ICO's fee pages when you register [2].

Paying the fee is not the same as being compliant

The fee registers you with the ICO; it does not make your practice compliant. Therapy notes are special category data under UK GDPR Article 9, which carries its own requirements — a documented lawful condition (usually explicit consent), appropriate security, and the ability to answer access and erasure requests. We cover that in detail in GDPR Article 9 for therapists, explained.

A simple checklist

Run the ICO's self-assessment to confirm you need to pay and which tier applies.
Register and pay the fee (tier 1 is £52 a year for most practices).
Diarise the renewal — the fee is annual.
Separately, make sure your record-keeping meets Article 9: documented consent, encryption, access controls, export and deletion on request.

Frequently asked questions

How much is the ICO fee for a small therapy practice?

Since 17 February 2025, the tier 1 fee for micro organisations (turnover up to £632,000 or no more than 10 staff) is £52 a year. Tier 2 is £78 and tier 3 is £3,763. Most solo and small practices are tier 1.

Does a self-employed therapist count as a data controller?

Yes, in almost all cases — you decide why and how client information is processed. Data controllers processing personal data electronically must pay the annual fee unless every part of their processing is exempt.

How do I check whether I need to pay?

Use the ICO's free online self-assessment on ico.org.uk — it takes a few minutes and tells you whether you must pay and at which tier.

What happens if I don't pay?

The ICO can issue a monetary penalty on top of the unpaid fee. Paying is a legal requirement under the Data Protection (Charges and Information) Regulations 2018, separate from your wider UK GDPR obligations.

Compliance handled inside your practice software

Caseload keeps consent signed and timestamped, records encrypted on EU servers, exports at thirty seconds and deletion at one click — so the part the ICO fee doesn't cover is handled too.

Book a demo

Sources

The Data Protection (Charges and Information) (Amendment) Regulations 2025 (S.I. 2025/63), in force 17 February 2025. legislation.gov.uk/uksi/2025/63/made
ICO — Guide to the data protection fee, including the self-assessment. ico.org.uk

This guide is general information for practitioners, not legal advice. Confirm your own position with the ICO's self-assessment.