Citation, commencement, extent and interpretation

1.—(1) These Regulations may be cited as the Data Protection (Charges and Information) (Amendment) Regulations 2025 and come into force on 17th February 2025.

(2) These Regulations extend to England and Wales, Scotland and Northern Ireland.

(3) In these Regulations, “ the 2018 Regulations” means the Data Protection (Charges and Information) Regulations 2018( 2).

Amendment of the Data Protection (Charges and Information) Regulations 2018

2.  Regulation 3(1) of the 2018 Regulations is amended as follows—

(a) in sub-paragraph (a), for “£40” substitute “£52”;

(b) in sub-paragraph (b), for “£60” substitute “£78”;

(c) in sub-paragraph (c), for “£2,900” substitute “£3,763”.

Transitional and saving provision

3.—(1) Regulation 3(1) of the 2018 Regulations continues to have effect for a charge period without the amendments made by regulation 2 of these Regulations where—

(a) the charge period began within the period beginning with 18th February 2024 and ending immediately before these Regulations come into force, and

(b) the data controller has paid the charge to the Information Commissioner for that charge period.

(2) In paragraph (1), “ charge period” and “ data controller” have the same meanings as in the 2018 Regulations.

Explanatory Note

(This note is not part of the Regulations)

The Data Protection (Charges and Information) Regulations 2018 ( S.I. 2018/480) (“ the 2018 Regulations”) set out the circumstances in which data controllers are required to pay a charge to the Information Commissioner. Regulation 2 of the 2018 Regulations requires a data controller to pay an annual charge to the Information Commissioner unless all of the processing by the data controller is exempt processing. Each annual period for which a charge must be paid is described as a “charge period”. Regulation 3 of the 2018 Regulations makes provision for the amount of the annual charge, prescribing three tiers of charges according to criteria relating to a data controller’s turnover and number of members of staff (or only members of staff, for a public authority). Charities and small occupational pension schemes are included in the lowest tier. The charge is reduced if a data controller pays the charge by direct debit.

These Regulations only make provision increasing the charges set out in the 2018 Regulations. The increases are less than the increase in the retail prices index since the 2018 Regulations were made.

Regulation 2 of these Regulations amends regulation 3(1) of the 2018 Regulations to increase the annual charges for each of the three tiers as described in regulation 3(2) of the 2018 Regulations. In particular—

(a) It increases the charge for tier 1 (micro organisations) from £40 to £52;

(b) It increases the charge for tier 2 (small and medium organisations) from £60 to £78;

(c) It increases the charge for tier 3 (large organisations) from £2,900 to £3,763.

Regulation 3 of these Regulations provides that the new charge does not apply for a charge period that is ongoing when these Regulations come into force if the data controller has already paid the fee for that charge period.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.