If your business handles any personal information — customer names, email addresses, employee records, even a simple mailing list — data protection law almost certainly applies to you. For most businesses, that means paying an annual fee to the Information Commissioner’s Office (ICO) and registering as a data controller. It’s an easy step to overlook, but it applies regardless of whether you’re a sole trader or a limited company.
Who needs to register
The requirement is based on what your business does with personal data, not its size or structure. You generally need to register (and pay the data protection fee) if you:
- Store or process personal data electronically — customer databases, email lists, an online booking system, CCTV footage
- Employ staff, since payroll and HR records count as personal data
- Use a website with any kind of contact form, newsletter sign-up, or analytics that identifies visitors
- Complete the online self-assessment tool on the ICO’s website, which asks a series of questions to confirm whether you need to register and what fee tier applies
- Pay the annual data protection fee — there are three tiers: £52 for micro organisations (turnover under £632,000 or 10 staff or fewer), £78 for small and medium organisations (turnover under £36 million or up to 250 staff), and £3,763 for larger organisations. Most small businesses and sole traders fall into the £52 or £78 tier, and paying by direct debit gets a £5 discount. Charities pay the £52 tier regardless of size.
- Registration is renewed annually, either automatically via direct debit or through a renewal reminder from the ICO
- Having a clear, accessible privacy notice explaining what data you collect and why
- Only collecting data you actually need, and not keeping it longer than necessary
- Having appropriate security in place — this doesn’t need to be elaborate for a small business, but “no protection at all” isn’t defensible
- Knowing how to respond if someone asks what data you hold on them, or asks you to delete it
- Having a plan for what to do if data is lost or breached
There are limited exemptions — for example, some businesses that only process personal data for core business functions like staff administration, advertising, marketing, and public relations for their own business, or that only keep data on paper, may be exempt. But most trading businesses, sole trader or limited company, fall inside the requirement once they hold any digital customer or employee data.
Example (sole trader): A freelance photographer who keeps client contact details and photos on a laptop, and uses an online booking tool, is very likely required to register — even working entirely alone.
Example (limited company): A small retail company running a customer loyalty scheme with names and email addresses on a spreadsheet needs to register, regardless of how few customers are on the list.
How to register
Registration is done directly with the ICO:
The process itself is quick — most businesses complete it in well under half an hour.
What registration doesn’t cover
Registering and paying the fee isn’t the same as being compliant with UK GDPR and the Data Protection Act. It’s a legal requirement in its own right, but genuine compliance also means:
Example: A sole trader who registers with the ICO but keeps client data in an unprotected spreadsheet shared over unencrypted email has paid the fee but hasn’t actually addressed the underlying obligations.
Penalties for not registering
Trading without registering when you’re required to isn’t a minor technicality — the ICO can and does issue fines for non-registration, separate from any penalty for a data breach itself. For most small businesses this is a modest, avoidable cost compared to the fine for being caught unregistered.
The practical starting point
For a new business, the sensible order is usually: run the ICO’s self-assessment tool early (it’s quick and free to check), register and pay the fee if required, and then put a basic privacy notice and data-handling practice in place proportional to the size of the business. None of this needs to be elaborate for a small operation — but skipping it entirely leaves an easily avoidable gap.