New funding model for the ICO

The Government has announced how the Information Commissioner’s Office (ICO) will be funded from the 25 May when the GDPR is enforced.

The new structure was laid before Parliament as a Statutory Instrument and will come into effect on 25 May 2018, to coincide with the General Data Protection Regulation (GDPR).

However, until the new rules come into force on 25 May, organisations are still obliged to register with the ICO and pay the current notification fee.

The new fee structure has been created based on the relative risk that an organisation poses from processing personal data.

The model is divided into three tiers and is based on a number of factors including size, turnover and whether an organisation is a public authority or charity.

The fees are:

Tier 1 – micro organisations. Maximum turnover of £632,000 or no more than ten members of staff. Fee: £40 (or £35 if paid by direct debit)

Tier 2 – SMEs. Maximum turnover of £36million or no more than 250 members of staff. Fee: £60

Tier 3 – large organisations. Those not meeting the criteria of Tiers 1 or 2. Fee: £2,900

Generally speaking, you must pay a fee if you're processing personal data but if you're processing personal data only for one (or more) of the following purposes then you're exempt from paying:

• Staff administration
• Advertising, marketing and public relations
• Accounts and records
• Not-for-profit purposes
• Personal, family or household affairs
• Maintaining a public register
• Judicial functions
• Processing personal information without an automated system such as a
• computer

The ICO have created a guide for organisations so they understand clearly the new fee structure.