# DPO necessity, representative and fee decision memo

Make three separate decisions: DPO requirement, territorial representative requirement and annual data protection fee. A fee registration is not a compliance certificate.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Describe the organisation and core activities

- Identify legal entities, establishments, controller/processor roles and the main activities that achieve the organisation’s objectives.
- Describe monitoring and sensitive processing, including numbers of people, volume, range, geographical reach and duration.
- Distinguish core activities from ancillary internal functions such as ordinary payroll.

Organisation / entities / establishments: 
Public-authority status and basis: 
Core activities and roles: 
Monitoring nature / regularity / scale: 
Special-category / criminal-offence processing and scale: 
Evidence and assumptions: 

## 2. Decide whether a DPO is required

- Assess each Article 37 trigger and record the conclusion. Do not infer large scale from a single numeric threshold.
- If appointing voluntarily, apply the same DPO role requirements. If no DPO is required or appointed, identify an adequately resourced privacy lead.
- Set review triggers for growth, monitoring, new sensitive services and changes in public-authority status.

Article 37 trigger-by-trigger assessment: 
Required / voluntary / not required decision: 
Reasoning and evidence: 
Privacy lead if no DPO: 
Decision approver and date: 
Review triggers and date: 

## 3. Assess independence and appointment arrangements

- Check whether the proposed DPO determines processing purposes or means in another role. Evaluate actual responsibilities rather than job title alone.
- Document resources, competence, reporting to the highest management level, access to processing and protection of independence.
- Record contact publication and regulator notification steps where applicable; keep actual appointment evidence.

Proposed DPO and qualifications: 
Other duties and conflict analysis: 
Reporting line / resources / access: 
Terms and independence provisions: 
Contact publication and notification record: 
Appointment evidence / review owner: 

## 4. Check the annual fee

- Use the current official self-assessment and the full exemption conditions. Staff administration, marketing and accounts are not the only statutory categories.
- Record turnover, staff calculation and any special organisational rules before selecting a tier. Current published tiers are £52, £78 and £3,763, subject to checking at the decision date.
- Record payment and renewal evidence. If claiming exemption, state the precise factual basis and review it when processing changes.

Assessment date and official tool outcome: 
Turnover / staff / organisational category: 
Fee tier or exemption with reasons: 
Annual fee and payment method: 
Registration / payment evidence: 
Renewal owner and date: 

## 5. Assess representative duties separately

- For organisations without a UK establishment, assess UK targeting or monitoring and Article 27 conditions and exemptions.
- For UK businesses operating under EU GDPR, assess the EEA establishment, targeting and monitoring position separately, using appropriate EU sources or advice.
- Distinguish a representative’s written mandate from the independent DPO role.

Applicable regime and territorial scope: 
Establishments / targeting / monitoring: 
Representative required? Reasoning: 
Exemption analysis if relied upon: 
Written mandate and contact details: 
Notice updates and review date: 

## 6. Record approval and actions

- Summarise the three decisions separately and identify unresolved facts.
- Assign actions for appointment, conflicts, publication, registration or renewal; verify completion.
- Review material changes to operations and legal requirements.

DPO decision: 
Representative decision: 
Fee decision: 
Action / owner / deadline / evidence: 
Approver and date: 
Next review and change triggers: 

## Sources

- ICO: Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/
- ICO: Fee tiers and assessment: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/
- ICO: Fee exemptions: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/
- ICO: Territorial scope and representatives: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/