What this review helps you do
DPO appointment, territorial-representative duties and the ICO fee require separate decisions. Record the facts used for each assessment, the responsible person and the next review trigger. A paid fee or a privacy job title does not by itself establish compliance or satisfy the DPO role requirements.
AT A GLANCE
Keep three decisions distinct: whether a DPO is required, whether a territorial representative is needed and whether the data protection fee is payable.
The legal position
A DPO is mandatory for relevant public authorities, or where core activities involve large-scale regular and systematic monitoring or large-scale special category/criminal-offence processing. The duty can apply to controllers and processors.
A DPO needs independence, resources, access to senior management and freedom from conflicting decisions about processing. A title alone is not the legal test; directors and senior IT, HR or marketing decision makers commonly create conflicts.
A voluntarily appointed DPO is subject to the same role requirements. If no DPO is required, record the assessment and assign an appropriate privacy lead.
Current annual fee tiers are £52, £78 and £3,763, with a £5 direct-debit reduction. Eligibility depends on the detailed staff, turnover, organisational and exemption rules; use the regulator’s self-assessment.
Separately assess territorial scope and representative duties. A non-UK organisation targeting or monitoring people in the UK may need an Article 27 UK representative; UK businesses subject to the EU GDPR may need an EEA representative. Limited exemptions require separate review.
What to review
- Assess core activities, monitoring, data sensitivity, scale and public-authority status.
- Review DPO terms, reporting line, access, resources, competence and conflicts.
- Confirm fee liability, tier, payment, contact details and annual renewal owner.
- Map cross-border targeting and establishments, then record any representative requirement separately.
Working outputs
- DPO necessity and conflicts memo
- Appointment terms checklist or privacy-lead decision
- Fee assessment record and renewal action
- UK/EEA representative screening record
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
- Is our DPO necessity decision documented and reviewed?
- Can the DPO advise independently without deciding the processing purposes and means?
- Have we checked the correct fee tier and exemption criteria?
- Is fee renewal allocated to someone?
- Have we considered Article 27 separately from the DPO role?
Current fee tiers
| Tier | Annual fee | How to assess it |
|---|---|---|
| Tier 1 | £52 | Micro organisations: check the ICO staff or turnover test and special rules. |
| Tier 2 | £78 | Small and medium organisations: check the ICO staff or turnover test. |
| Tier 3 | £3,763 | Organisations outside the lower tiers, subject to applicable exceptions. |
Use the official fee checker for the exact classification. A £5 reduction applies for direct debit. Registration is not a compliance certification.
Implementation tip
The fee is not a licence or a compliance certificate. A registration entry does not establish that an organisation meets UK GDPR obligations.
Apply the limits carefully
This review can prepare the decision record. Appointment, registration and payment require the organisation’s own confirmed details and authorised action.
Common misunderstandings
Fee exemptions cover more than staff administration, accounts and marketing. Eligibility depends on the full statutory categories and conditions, so the organisation’s actual processing needs to be assessed.
The ordinary fixed non-payment penalties are £400, £600 and £4,000 by tier. The regulator’s policy also describes circumstances in which the statutory maximum of £4,350 may apply.
Fee liability and the need for a DPO are separate questions. A small organisation may have to pay the fee without being required to appoint a DPO.
The legal regulator became the Information Commission on 30 September 2026. The organisation continues to use the ICO name, now the Information Commission’s Office.
Worked example: reviewing a changed privacy role
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A fictional organisation appoints its operations director as DPO while that director also chooses the purposes and systems used for staff monitoring.
- Control
An appointed DPO should be able to advise and monitor independently, with appropriate resources and without conflicting processing decisions.
- Evidence
Review the appointment, reporting line, decision-making powers, resources and the organisation's documented assessment of whether a DPO is required.
- Finding
The title is present, but the recorded responsibilities indicate a potential conflict that has not been assessed.
- Owner and action
Senior management assesses and resolves the role conflict, documents the appointment or alternative arrangements and separately assigns the fee and representative reviews.
- Verification
Check the agreed role description, reporting access and escalation route in operation. Revisit the assessment when duties or core activities change.
Practical questions
What evidence supports a decision that a DPO is not required?
Record the organisation's status, core processing activities, relevant scale and monitoring or sensitive-data factors. Identify who made the assessment and the changes that would prompt another review.
How should fee renewal be managed?
Keep the completed liability and tier assessment, payment or exemption evidence and a responsible renewal owner. Recheck the underlying facts when the organisation changes instead of relying solely on last year's payment.
Official sources
- ICO: Data protection officers (opens in a new tab)
- ICO: Guide to the data protection fee (opens in a new tab)
- ICO: Fee exemptions (opens in a new tab)
- ICO: Fixed non-payment penalties (opens in a new tab)
- ICO: Receiving information from the EEA and territorial scope (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.