Who pays
The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee, unless they are exempt. Client names, contact details and health answers are personal information.
Paying the fee is often called registering with the ICO.
The three fee tiers
- Tier 1, £52: a maximum turnover of £632,000 for the financial year, or no more than 10 members of staff.
- Tier 2, £78: a maximum turnover of £36 million, or no more than 250 members of staff.
- Tier 3, £3,763: for organisations that meet neither of those.
The ICO gives a £5 discount when you pay by direct debit. A solo therapist will almost always be in tier 1.
Check if you are exempt
The ICO says not all controllers must pay, and many can rely on an exemption. Its self-assessment tool helps you decide whether you need to pay and how much, and takes about 10 minutes.
Do the check once, and keep a note of the result and the date.
Paying the fee is not the whole job
The fee is separate from your other data protection duties. You also need to tell clients what you do with their information, keep it safe, and not hold it for longer than you need.
The ICO has free guidance for small organisations and sole traders, including a tool to create your own privacy notice.
What to keep in your files
It helps to keep a small data protection folder, on paper or on your computer. Put in it:
- The date you did the ICO self-assessment, and the result.
- Proof of payment, and the renewal date.
- Your privacy notice.
- Your policy on how long you keep client records.
- A note of who can see client information, such as a supervisor or an assistant.
If you are asked about your data protection, you can then show what you do. Set a reminder each year to review the folder and renew the fee on time.
Do not leave it to the last minute. The ICO says the self-assessment takes about 10 minutes, so it is a small job to put in your diary. If your work changes, for example you take on staff or start a new service that uses client information in a different way, do the check again and see if the tier or your other duties have changed.
If you are unsure at any point, the ICO has a helpline and guidance written for small organisations and sole traders.
More questions
How much is the ICO fee?
The ICO currently lists £52 for tier 1, £78 for tier 2 and £3,763 for tier 3, with £5 off for direct debit. Most solo therapists are in tier 1.
Can I check if I am exempt?
Yes. The ICO has a free self-assessment that takes about 10 minutes.
Does the fee cover my GDPR duties?
No. It is a separate payment. You still need to keep client information safe and tell clients how you use it.
