ICO Register: How to Check a Company, Your Fee Tier and Renewal
What an ICO register entry proves, how to check a supplier in ten minutes and what your own data protection fee should cost.
The ICO register is the public list of more than one million organisations that have paid the UK data protection fee. You can search it for free by registration reference, postcode or name. Each entry shows the fee tier paid, the registration date and the expiry date.
In short
- Search the ICO register using one field at a time, ideally the registration reference, and check that the expiry date is still in the future.
- A register entry or ICO certificate proves the fee was paid. It is not an audit and it does not show compliance.
- The fee is £52 for tier 1, £78 for tier 2 and £3,763 for tier 3, with £5 off for direct debit and no VAT.
- Tier 1 applies if turnover is no more than £632,000 or staff are no more than 10, so a small team with high turnover can still qualify.
- Missing a renewal can lead to a fixed penalty of £400, £600 or £4,000 depending on tier, and up to £4,350 in aggravating cases.
The ICO register is the public list of more than one million organisations that have paid the UK data protection fee to the Information Commissioner's Office1. You can search it for free by registration reference, postcode or name. Each entry shows the fee tier paid and when the registration expires2.
That makes it the quickest due diligence check a B2B team can run before handing customer data to an agency, a data supplier or a software vendor. It also gets misread a lot. This guide covers what an entry proves and what it doesn't, plus what your own fee should cost.
What is the ICO register?
The Information Commissioner is the UK regulator for data protection and other information rights5. The ICO says every organisation that processes personal information must pay it a fee unless an exemption applies. Not paying leads to a fixed penalty1.
The register is the published list of who has paid. For each fee payer the ICO publishes the name and address of the controller, the registration reference, the level of fee paid, the date registered and the expiry date. It also shows any other trading names and the Data Protection Officer's contact details if the ICO has been told of one1. A controller is the organisation that decides why and how personal data is used.
In plain terms, it is a public receipt book. That is useful, but you need to keep in mind that it records payment and nothing else.
How do I check if a company is on the ICO register?
This takes about ten minutes, and it's worth doing before you sign with anyone who will handle your contacts, customer records or website data.
- Open the ICO's search the register page.
- Search one field at a time. The ICO recommends the registration reference first. If you don't have it, search by postcode alone or name alone2. Try the legal entity name from the contract before any brand name.
- Open the entry and check four things: the legal name matches the company on your contract, the expiry date is in the future, the fee tier looks plausible for the firm's size, and a DPO contact appears if the supplier told you it has one.
- If nothing comes up, don't jump to conclusions. Changes can take up to two working days to appear2. Ask the supplier for its registration reference. For register queries the ICO's helpline is 0303 123 11132.
One thing to keep in mind: the fee duty sits with controllers, and some organisations are exempt. A missing entry is a question to ask, not proof of wrongdoing. If your supplier collects data about your website visitors, the register check sits alongside the bigger questions in our guide to visitor identification under UK GDPR and PECR. Those questions are where data is hosted, what is stored and for how long. Scout, for example, is hosted in the UK and EEA and never stores raw IP addresses. Those are the kinds of specific answers to ask any vendor for.
What does an ICO certificate prove?
You can download a registration certificate from the register. New registrations and certificates take two working days to become available1. The ICO's own description is that being listed shows you are aware of your data protection obligations3.
Our view: a certificate proves the fee was paid for a given period. It isn't an audit. It says nothing about whether a supplier's cold emails follow PECR (the Privacy and Electronic Communications Regulations, the UK rules on marketing emails, calls and cookies) or whether its security is any good.
The timing detail matters too. The fee covers 12 months from the renewal date, not the payment date, and the ICO doesn't treat you as covered until it receives a payment it can match to you4. A PDF certificate in last year's tender pack tells you nothing about whether the supplier renewed. Check the live register instead.
How much is the ICO fee, and is VAT added?
The ICO sets out three tiers3:
| Tier | Who it covers | Annual fee |
|---|---|---|
| Tier 1: micro | Turnover up to £632,000 or no more than 10 staff | £52 |
| Tier 2: small and medium | Turnover up to £36 million or no more than 250 staff | £78 |
| Tier 3: large | Anyone not meeting tier 1 or tier 2 | £3,763 |
The word that matters is "or". You only need to pass one of the two tests. An eight-person consultancy turning over £1.5 million is tier 1 because of its headcount. A 40-person agency turning over £3 million is tier 2. Public authorities, charities and small occupational pension schemes have their own criteria3.
Paying by direct debit takes £5 off3, so that agency pays £73. There is no VAT. The ICO states that statutory fees are outside the scope of VAT, so it doesn't charge any4. The ICO's online fee checker (its self-assessment) confirms whether you need to pay and which tier applies, and registering online takes about 15 minutes3.
Two warnings from the ICO itself. First, private agencies that offer to pay the fee for you often charge more than the standard cost and have no official standing. Second, there are scams around fee payment. Genuine correspondence always directs you to pay through ico.org.uk3.
What happens if you don't renew the ICO fee?
The ICO contacts you before your registration expires. If you don't pay, or tell it why you no longer need to, it can issue a notice of intent 28 days after expiry. You then have 28 days to pay or make representations4.
After that come fixed penalties: £400 for tier 1, £600 for tier 2 and £4,000 for tier 3. The ICO can raise this to a statutory maximum of £4,350 where there are aggravating factors, such as failing to cooperate5. Between May 2021 and January 2022 it issued 126 penalties for non-payment, and it publishes the names of most organisations it fines3.
The maths is lopsided. A tier 2 firm that forgets a £78 payment risks a £600 penalty, nearly eight times the fee, plus its name on a public list. A direct debit and a renewal date in the finance calendar remove the risk.
Can you use the ICO register as a lead list?
Sales teams sometimes notice that the whole register can be downloaded as a dataset and that it is updated daily6. A million named organisations with addresses looks like a prospect list.
Read the small print first. The dataset is available under the Open Government Licence, but the ICO says that licence doesn't cover the personal data in it, and your data protection obligations still apply6. Many entries name people. Sole traders register in their own right3, and DPO names are published where they have consented1.
There is also a practical problem. The register tells you who paid a fee, not who needs what you sell. Before you contact anyone from a list like this, read our guide on whether it is legal to contact companies that visited your website and our summary of the Data (Use and Access) Act marketing changes.
Who is reading, not just who has paid
The ICO register answers a compliance question: has this organisation paid? Finding buyers is a different question: which companies are actually researching what you sell? Scout identifies the company, not the person, behind each website visit. It shows the pages read and the search queries associated with each company, using your own GA4 and Search Console data, with a confidence score on every match.
You can start a 14-day free trial with no card needed.
Frequently asked questions
What is the ICO in the UK?
The Information Commissioner's Office is the UK regulator for data protection and other information rights. It collects the annual data protection fee, publishes the register of fee payers and can fine organisations that should pay but don't.
How do I check if a company is registered with the ICO?
Use the ICO's free search the register page and search one field at a time, ideally the registration reference, otherwise the postcode or name. Check that the expiry date is in the future. New registrations can take up to two working days to appear.
Is there VAT on the ICO data protection fee?
No. The ICO states that statutory fees are outside the scope of VAT, so no VAT is charged. Tier 1 costs £52, tier 2 £78 and tier 3 £3,763, with £5 off if you pay by direct debit.
How do I get my ICO certificate?
Download it from the ICO register of fee payers, ideally by searching your registration reference or, failing that, your postcode. New registrations and certificates take two working days to become available. A certificate only proves the fee was paid for that period.
What happens if I don't pay the ICO fee?
The ICO can issue a notice of intent 28 days after expiry, then gives you 28 days to pay or explain. Fixed penalties are £400, £600 or £4,000 depending on tier, and up to £4,350 in aggravating cases.
Sources
- ICO: Register of fee payers and certificate downloads ico.org.uk
- ICO: Search the register ico.org.uk
- ICO: Registration FAQs (data protection fee payment and online registration) ico.org.uk
- ICO: Data protection fee frequently asked questions ico.org.uk
- ICO: Fixed penalties for failure to pay the data protection charge ico.org.uk
- ICO: Download the register ico.org.uk