Home › Online shops › Fees, payments and postage
Fees, payments and postage
Does my online shop have to pay the ICO data protection fee? The £52, £78 and £3,763 tiers and the exemption test
Most small UK online shops pay the ICO £52 or £78 a year, £5 less by Direct Debit. How the three tiers work and when the accounts-and-records exemption applies.
If you run an online shop in the UK, the Information Commissioner's Office (ICO) may expect you to pay a data protection fee every year. For most small shops it is £52 or £78, and £5 less if you pay by Direct Debit. Some shops owe nothing, but only if everything they do with customers' details fits a short list of exempt purposes.
The fee is separate from the rest of data protection law. Even a shop that pays nothing still has to follow the other rules. The ICO says that "even if you are exempt from paying a fee, you still need to comply with your other data protection obligations."
Who has to pay
The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. The Data Protection (Charges and Information) Regulations 2018 set the rule in regulation 2: a data controller must comply "unless all of the processing of personal data they undertake is exempt processing". The word that matters is "all". One use of customer details outside the exempt list is enough to make you pay.
An online shop is a data controller because it decides why and how it uses names, addresses, emails and order histories.
The three tiers
| Tier | Who it covers | Yearly fee | By Direct Debit |
|---|---|---|---|
| 1, micro | Turnover of up to £632,000 in your financial year, or no more than 10 members of staff | £52 | £47 |
| 2, small and medium | Turnover of up to £36 million, or no more than 250 members of staff | £78 | £73 |
| 3, large | Anyone who meets neither of the tests above | £3,763 | £3,758 |
The ICO says that if you choose Direct Debit you receive "an automatic discount of £5 at point of payment".
The tests are joined by "or". You pay the lowest tier whose turnover test or staff test you meet. That catches shops that sell a lot with a tiny team.
Four invented shops
| Shop | Turnover | Staff | Tier | Fee by Direct Debit |
|---|---|---|---|---|
| Candle seller, one person | £90,000 | 1 | 1 | £47 |
| Pet-supplies shop, six people | £1.8 million | 6 | 1 (staff test) | £47 |
| Furniture shop, 40 people | £1.8 million | 40 | 2 (turnover test) | £73 |
| National chain, 300 people | £40 million | 300 | 3 | £3,758 |
The pet-supplies shop turns over nearly three times the tier 1 limit, yet pays £52 because it has no more than 10 staff. The Direct Debit saving is 9.6% of £52 and 6.4% of £78. Over ten years that is £50 for either fee.
The exemption test
You do not need to pay if you process personal data only for one or more of these purposes, according to the ICO:
- staff administration
- advertising, marketing and public relations
- accounts and records
- not-for-profit purposes
- personal, family or household affairs
- maintaining a public register
- judicial functions
- processing without an automated system
For a shop, the one to look at is accounts and records. The ICO describes it as keeping accounts for your business, deciding whether to accept someone as a customer, and keeping records of purchases, sales and other transactions so that payments and deliveries happen. It limits the people covered to customers and suppliers whose details you need for that, and the information to what is necessary, such as name, address and card details.
So a shop that uses customers' details only to take payment, send the parcel, keep its accounts and market its own products may well be exempt. The moment you use the data for something outside the list, the exemption falls away. The ICO runs a self-assessment tool for exactly this judgement, and its guidance says that if you think you are exempt you can tell the ICO at ico.org.uk/no-fee.
We could not check a figure for the penalty for not paying on the ICO's own pages, so we leave it out. The ICO says only that "if you need to pay and don't pay, you could be fined."
What to do this week
- Find out whether you have paid before. A fee letter means the ICO already holds your details; use the renew option at ico.org.uk/fee.
- List every reason you hold customers' details: order fulfilment, accounts, marketing emails, reviews, anything else. Mark each as inside or outside the exempt list.
- Use the ICO self-assessment before you pay or decide you are exempt, and keep a dated screenshot of the result.
- If you pay, set up Direct Debit for the £5 and put the renewal date in your calendar.
For how long you may keep what you collect, see how long an online shop must keep order records and customer data. If you are thinking of feeding customer emails to a chatbot, read whether you can use ChatGPT on customer emails first, because that is exactly the kind of new use that belongs on your list in step 2. The fee also belongs in your yearly costs in the product margin calculator.
Overlyft can set up an AI assistant that keeps this list of data uses up to date as your shop adds tools, and flags the renewal date, for a person to check and pay.
This is general information, not legal advice. The ICO's self-assessment gives the answer for your shop.
Where this comes from: ICO, "Data protection fee" (fee tiers and Direct Debit discount), "Exemptions" and "Data protection fee: what you need to do" (small organisations guidance), ico.org.uk; Data Protection (Charges and Information) Regulations 2018, regulation 2, legislation.gov.uk; all read 2026-10-06. The four shops in the worked example are invented.
AEO Lookup editorial team
We write practical guides for people who run small UK firms, and we check every fact against its source on the date shown. Read how we review, or tell us if something has changed.
