ICO registration for therapists: do you need to pay the fee?

Whether UK therapists and practitioners must pay the ICO data protection fee, the current tiers, the exemptions, how to pay, and what happens if you don't.

MyWellOps teamPublished 28 September 2026 · 5 min read

“Do I need to register with the ICO?” is one of the first questions new practitioners ask. It’s also one that gets answered badly in forums, usually with “only if you’re a big clinic” or “not if you only keep paper notes”. Neither is a safe rule.

Strictly speaking, you don’t register with the Information Commissioner’s Office any more. What you do is pay the data protection fee, and in return you’re added to the ICO’s public register of fee payers. The fee is required by the Data Protection (Charges and Information) Regulations 2018. This guide covers who has to pay it, how much it costs, the exemptions and how to pay.

Who has to pay

The ICO’s starting point is broad. Organisations, including sole traders, that use personal information need to pay a data protection fee unless they’re exempt. If you’re a controller (you decide why and how client information is used) and no exemption applies, you pay.

For health and care practitioners, the ICO’s sector guidance is specific:

Counsellors: if you provide a counselling service and hold personal information electronically, you’re required to pay the fee.
Therapists and private practitioners: the ICO gives examples including occupational therapy, speech and language therapy, physiotherapy, chiropractic, acupuncture, audiology and dermatology. If you’re responsible for the records you hold, including any treatment and care received, you need to pay.

So a self-employed therapist who keeps client details, session notes or appointment history on a laptop, phone or online system should expect to pay.

How much it costs

There are three tiers, based on your size. The criteria use “or”, so you only need to meet one of them to fall into a tier.

Tier	Who it’s for	Annual fee
Tier 1: micro organisations	Turnover of up to £632,000 for your financial year, or no more than 10 members of staff	£52
Tier 2: small and medium organisations	Turnover of up to £36 million for your financial year, or no more than 250 members of staff	£78
Tier 3: large organisations	Anyone not in tier 1 or 2	£3,763

If you pay by direct debit, you get an automatic £5 discount. Charities pay the tier 1 fee whatever their size or turnover.

Almost every solo practitioner and small clinic is in tier 1. These amounts follow a government decision to raise the fees across all tiers by 29.8%. The previous tier 1 fee was £40.

The fee covers 12 months from your renewal date (not the date you pay), and you pay every year. The ICO contacts you before your payment runs out. Statutory fees are outside the scope of VAT, so there’s no VAT to add.

The exemptions

You’re exempt only if you process personal data only for one or more of these purposes:

staff administration
advertising, marketing and public relations
accounts and records
not-for-profit purposes
personal, family or household affairs
maintaining a public register
judicial functions
processing personal information without an automated system such as a computer

(Members of the House of Lords, elected representatives and prospective representatives are also exempt.)

The word that matters is only. The accounts and records exemption covers keeping a client’s name and address for invoicing. Session notes, health information and treatment history go further than that, so a practitioner holding them can’t rely on it.

The manual-processing exemption is where “paper notes don’t count” comes from. It only helps if you use no automated system for any client information: no diary app, no email, no spreadsheet of contacts, no online booking. Very few practices today work like that.

Even if you are exempt, the ICO is clear that you still have to comply with your other data protection obligations. Being exempt from the fee doesn’t mean being exempt from UK GDPR.

If you’re unsure, the ICO has a short self-assessment tool that tells you whether you need to pay and which tier you’re in.

How to pay

You can pay the fee online on the ICO’s website. For a first payment, the ICO asks for:

the name of your organisation (as a sole trader, that’s you and any trading name)
the best way to contact you
the tier you think you fall into

You can pay by direct debit (with the £5 discount), by credit or debit card, or by cheque. After you pay, you get a registration reference, and you appear on the public register of fee payers.

It’s worth knowing what that register shows. The ICO publishes the name and address of the controller, the registration reference, the fee level paid, the registration and expiry dates, and any other trading names. If you work from home and would rather not have your home address public, think about which address you give before you pay.

What happens if you don’t pay

Processing personal data as a controller without paying the fee, or without paying the right amount, breaks the law. The ICO can issue a notice of intent and then a fine. Its guidance gives the maximum penalty as £4,350.

In practice the bigger risk is less direct. Clients, insurers and professional bodies increasingly check the register, and not appearing on it is an easy thing for someone to notice.

Paying the fee is the easy part

The fee is cheap and quick. The obligations that go with holding client data take more work:

A privacy notice saying what you collect, why, your lawful basis, and how long you keep it.
A retention policy. UK GDPR says you must not keep personal data for longer than you need it. See our guide to how long to keep client notes.
Security. Lock devices, use strong passwords, and know where your data physically lives.
Processors. Any software that stores client data for you is processing it on your behalf. Check its terms and where it hosts data. MyWellOps, for example, hosts data in Frankfurt, Germany.

Quick answers

I’m a sole trader seeing a handful of clients. Do I really need to pay? If you hold client information electronically, almost certainly yes, at the tier 1 rate.

I work for an agency or clinic and also see a few private clients. The ICO’s health and social care guidance says that if you’re employed through an agency, you’re not required to pay, but if you conduct private consultations you may be. Use the self-assessment tool for your private work.

Can I claim the fee as a business expense? That’s a tax question. Check with HMRC or your accountant.

I’ve been practising for a while and never paid. What should I do? Pay now, using the self-assessment tool to confirm your tier. If you have questions about the past, contact the ICO directly.

For anything specific to your situation, check with the ICO. It publishes its guidance and contact details on its website.

Get booked

Run the session

Stay in touch

Get paid

Grow