Home › Solicitors › SRA, AML and transparency
SRA, AML and transparency
The ICO data protection fee for a law firm: £52, £78 or £3,763, £5 off by direct debit, and the 21-day window
The 2018 Charges Regulations set three fees, £52, £78 and £3,763, with £5 off for direct debit. A table shows the net fee and what the £5 is worth in each tier.
A solicitors' firm holds names, addresses, bank details and family histories for every client, so it is a data controller. The renewal notice from the Information Commissioner's Office arrives, someone pays it, and nobody records what was paid, which tier applies, or whether the firm is being asked for the right amount. The fee is small beside most practice costs, but it is a legal charge with a filing window attached.
What the regulations say
As summarised from legislation.gov.uk on 30 October 2026:
- The amounts (regulation 3). Tier 1 (micro organisations) is £52, tier 2 (small and medium organisations) is £78, and tier 3 (large organisations) is £3,763. The sums were substituted on 17 February 2025 by SI 2025/63. The page showed no outstanding changes.
- Direct debit. The charge "is reduced by £5.00" for a data controller that pays by direct debit.
- Information to give (regulation 2). Within the first 21 days of each charge period, the controller gives its name and address, its staff numbers on the first day of the period (10 or fewer, over 10 up to 250, or over 250), its turnover for the financial year (up to £632,000, over £632,000 up to £36 million, or over £36 million) and whether it is a public authority.
The fee table
The arithmetic is the regulation 3 amount minus £5.00, and £5 divided by the full amount.
| Tier | Fee | Fee by direct debit | £5 as a share of the fee |
|---|---|---|---|
| 1 (micro) | £52 | £47 | 9.6% |
| 2 (small and medium) | £78 | £73 | 6.4% |
| 3 (large) | £3,763 | £3,758 | 0.13% |
Checks. 52 minus 5 is 47; 78 minus 5 is 73; 3,763 minus 5 is 3,758. 5 divided by 52 is 0.0962; by 78, 0.0641; by 3,763, 0.00133.
A firm that pays by card or invoice each year and has a tier 1 fee spends £5 more than it needs to, a tenth of the bill. Across a group of 10 small firms all in tier 1, that is £50 a year.
AI staff and workflows for high-street solicitors. Starting with conveyancing client updates.See what we would set upThe 21-day window as a diary entry
Say the firm's charge period starts on 1 December 2026. If day 1 is the first day of the period, the 21st day is 21 December 2026 (1 December plus 20). A diary reminder 7 days into the period falls on 8 December 2026, leaving 14 days (21 minus 7). The reminder is a suggestion for a firm to set, not a legal rule. The regulations as I read them do not say whether the first day counts, so allow the earlier date.
What I could not read
I did not read how the staff and turnover bands combine to place a firm in tier 1, 2 or 3; the regulation 2 page lists the bands separately and the combination is not on it. Nor did I read the exemptions, the penalty for non-payment, or how the Information Commission changes from 30 September 2026 affect renewal notices. The ICO self-assessment page gave no figures. Check which tier applies on the ICO's own tool before paying, and confirm the charge period dates on your notice.
Where this meets the rest of the compliance file
- Put the fee date next to the other annual items in the small law firm compliance readiness check.
- If the firm uses AI tools on client files, note that the data protection side is separate from the SRA warning notice on AI.
- For records the firm must keep and for how long, see how long solicitors must keep client files.
Overlyft builds AI staff who join your firm's team, read the renewal notice, record the tier, the amount and the direct debit status, and put the 21-day date in the diary, with a person approving each entry.
This is general information, not legal advice. Check the current legislation and your own obligations for each client.
Where this comes from: legislation.gov.uk, The Data Protection (Charges and Information) Regulations 2018 (SI 2018/480), regulation 3 (charge amounts, substituted 17 February 2025 by SI 2025/63; direct debit reduction of £5.00) and regulation 2 (information to be given within 21 days of each charge period, with the staff bands of 10 and 250 and the turnover bands of £632,000 and £36 million), https://www.legislation.gov.uk/uksi/2018/480/regulation/3 and /regulation/2. The pages were fetched through a summarising tool, not read line by line. The ICO page https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/ was also fetched and gave no fee figures. Read 30 October 2026.
AEO Lookup editorial team
We write practical guides for people who run small UK firms, and we check every fact against its source on the date shown. Read how we review, or tell us if something has changed.
