United KingdomData Protection (Charges and Information) Regulations 2018, Annual Charge and Information Duty for Data Controllers
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Licensing, Reporting
- Audit expectation
- none
What it requires
- Pay the annual data protection charge to the Information Commission within the first 21 days of each 12-month charge period, unless all of the personal data processing you do is exempt processing, under regulation 2(2) of the Data Protection (Charges and Information) Regulations 2018.
- Within the same 21 days, give the Information Commission your name and address, whether you have 10 or fewer, up to 250, or more than 250 members of staff, whether your turnover is up to £632,000, up to £36 million or more (a public authority gives no turnover band), and whether you are a public authority, under regulation 2(3).
- Pay £52 if you are a micro organisation (turnover of £632,000 or less, 10 or fewer members of staff, a charity or a small occupational pension scheme), £78 if you are a small or medium organisation (turnover of £36 million or less, or 250 or fewer members of staff) and £3,763 if you are a large organisation, each reduced by £5.00 when you pay by direct debit, under regulation 3.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Penalty structure
Data Protection Act 2018 s. 158(3) caps the fixed penalty the Information Commission may specify for failing to comply with the charges regulations at 150% of the highest charge payable under them, disregarding discounts. The highest charge is the tier 3 charge of £3,763 in regulation 3(1)(c), so the cap is £5,644.50.
- Rule
- Fixed only
- As of
- Currency
- GBP
- Fixed cap
- 5644.5
Who enforces it
Settledness
- As of
What it makes you log
Logging duty
Regulations 2 and 3 require a controller to pay a charge and to give the Information Commission stated information once in each charge period. They state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Regulation 2(2) of the Data Protection (Charges and Information) Regulations 2018 requires a data controller to pay a charge to the Information Commission within the first 21 days of each charge period. Regulation 2(3) requires a data controller to give the Information Commission its name and address, a staff-number band and whether it is a public authority. The charge is £52 for a micro organisation, £78 for a small or medium organisation and £3,763 for a large organisation.
Subject to regulation 3(3), a controller is in tier 1 if it has a turnover of £632,000 or less, ten or fewer members of staff, is a charity or is a small occupational pension scheme. Payment by direct debit reduces the applicable charge by £5.00. A data controller need not comply with regulation 2 if all of the processing of personal data it undertakes is exempt processing. Processing undertaken for the purposes of a person's personal, family or household affairs is exempt processing.
These Regulations bind the Crown. Section 158 of the Data Protection Act 2018 caps a fixed penalty for failing to comply with the charges regulations at 150% of the highest charge payable.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .