NEWS21 February 2018

New funding model for ICO

UK – The government has announced a new charging structure for data controllers for future funding of the Information Commissioner’s Office (ICO) based on the relative risk of the data processed by an organisation.

Data protection mechanism_Crop

The model is divided into three tiers and based on factors including size, turnover and whether an organisation is a public authority or charity.

For very small organisations, the fee won’t be any higher than the £35 they currently pay (if they pay by direct debit). Larger organisations will be required to pay £2,900.

The new structure was laid before Parliament yesterday and will come into effect on 25 May 2018 – to coincide with the General Data Protection Regulation (GDPR).

The ICO’s data protection work is currently funded through fees levied on organisations processing personal data (unless they are exempt) according to the Data Protection Act 1998.

From 25 May, the ICO fee will be replaced by the new funding model as detailed in the ICO Guide to the Data Protection Fee.

There will continue to be financial penalties for not paying fees, but these will be in the form of civil monetary penalties rather than a criminal sanction.