ICO registration for counsellors and therapists: who pays, how much, how

The data protection fee is an annual charge that organisations, including sole traders, must pay to the Information Commissioner's Office (ICO) when they use personal information, unless an exemption applies. People often call it "ICO registration", because once you pay, your name goes onto the ICO's public register of fee payers.

For counsellors, psychotherapists and other practitioners setting up on their own, it is one of the first compliance tasks. It is also one of the simplest. This guide explains who pays, how much, which exemptions exist and why they rarely apply to client work, and how to pay step by step.

Who has to pay the data protection fee

The rule comes from the Data Protection (Charges and Information) Regulations 2018. The ICO summarises it in one sentence. Organisations "(including sole traders) that use personal information need to pay a data protection fee, unless they are exempt."

A self-employed counsellor is a sole trader. Client names, contact details, session notes, invoices and emails are all personal information.

The British Association for Counselling and Psychotherapy (BACP) is just as direct in its GDPR FAQs. It states: "All businesses (including sole traders) processing personal information electronically must register with the ICO and pay a fee."

The same logic applies to speech and language therapists, occupational therapists, physiotherapists, dietitians and psychologists who run their own practice. If you are the one deciding what client data you collect and how you use it, the fee is in your name.

How much it costs in 2026

Regulation 3 of the 2018 Regulations sets three tiers. The amounts were last changed by the Data Protection (Charges and Information) (Amendment) Regulations 2025 (SI 2025/63), with effect from 17 February 2025.

• Tier 1, micro organisations: £52 a year.
• Tier 2, small and medium organisations: £78 a year.
• Tier 3, large organisations: £3,763 a year.

Under regulation 3(5), the charge is reduced by £5 if you pay by direct debit. So tier 1 costs £47 by direct debit.

Which tier applies to you

The ICO places you in a tier using your staff numbers and annual turnover.

• Tier 1 applies if your turnover is no more than £632,000 for the financial year, or if you have no more than 10 members of staff.
• Tier 2 applies if you are not in tier 1 and your turnover is no more than £36 million, or you have no more than 250 members of staff.
• Tier 3 applies to everyone else.

Regulation 3(2) also places charities and small occupational pension schemes in tier 1.

Note the word "or". You only need to meet one of the two conditions. A practitioner working alone, or with a small team of up to 10 staff, meets the tier 1 staff condition whatever the turnover.

For staff counts, the ICO includes employees, workers, office holders and partners. You use the average over your financial year, and each part-time person counts as one. Staff based overseas count too.

One detail matters. The ICO says it treats all controllers as eligible for tier 3 unless they say otherwise. When you fill in the form, give your staff numbers and turnover so you are placed in the right tier.

The exemptions, and why they rarely cover client work

The Schedule to the 2018 Regulations lists exempt processing. The ICO puts it plainly. You don't need to pay a fee "if you are processing personal data only for one (or more) of the following purposes." The key word is "only".

The exempt purposes are:

• staff administration;
• advertising, marketing and public relations for your own business;
• accounts and records, such as keeping accounts and records of transactions;
• not-for-profit purposes, for a body that is not run for profit;
• personal, family or household affairs;
• maintaining a public register;
• judicial functions;
• members of the House of Lords, and elected and prospective representatives;
• processing personal data without an automated system.

Holding clinical notes about clients and running therapy sessions do not appear on this list. Those activities are the core of a practice. On our reading of the Schedule, purpose-based exemptions such as accounts or marketing are therefore unlikely to cover them. This is a reading of the wording, not a legal ruling, and it matches BACP's position quoted above.

The paper exemption

That leaves the exemption for non-automated processing. Paragraph 2(2)(a) of the Schedule covers personal data "which is not being processed wholly or partly by automated means or recorded with the intention that it should be processed wholly or partly by automated means". The ICO describes it as processing "without an automated system such as a computer."

In practice this is a narrow door. Typed notes, an online diary, client emails, text messages, video sessions and invoicing software all involve a computer or a phone. Practitioners who use any of these are processing electronically, which is exactly the case where BACP says you must register and pay. The BACP FAQs also say that paper records "are not recommended and should be used only in extreme circumstances."

If you are unsure, the ICO offers a free self-assessment. It takes about 10 minutes and tells you whether you need to pay and how much.

How to pay, step by step

1. Check you need to pay. Use the ICO data protection fee self-assessment if you have any doubt.
2. Gather your details first. The ICO asks you to complete the form in one session. Have your name or business name, your address, your staff numbers and your turnover ready.
3. Start a new registration. Go to the ICO's register page and choose to start a new registration application. The ICO says it takes about 15 minutes.
4. Pay. Have your credit or debit card details ready if you pay by card. The ICO's pay or renew page says American Express cards are not accepted. The ICO does not issue invoices, because registration is required by law.
5. Set up a direct debit if you want the £5 reduction. The ICO's renewal page lets you set one up online. Direct debit payments are then taken automatically each year until you cancel.
6. Wait for confirmation. The ICO usually sends confirmation the working day after it receives payment. Your entry appears on the register of fee payers within seven working days.
7. Download your certificate. You can download it from the register of fee payers. Keep your registration reference somewhere safe, because you need it to renew or pay by bank transfer.

Renewing every year

The fee is annual. The ICO's renewal service is described as the way to "pay or renew your annual data protection fee." You can pay by card, direct debit, BACS bank transfer or cheque. A bank transfer must include your registration reference, or the ICO cannot match the payment.

Direct debit is the simplest option for a small practice. It saves £5, and payment is taken each year without you having to remember it.

What happens if you do not pay

The ICO is clear about the risk. On its page listing penalty notices for non-payment, it says: "if you fail to pay when you should, you could be fined up to £4,000." That figure is many times the tier 1 fee.

The ICO publishes a list of penalty notices issued for non-payment. It states that, for privacy reasons, this list does not include any personally identifiable sole traders or partnerships. So you would not see a solo counsellor named there. The ICO's main fee page still says sole traders must pay.

The register of fee payers is public

Anyone can search the ICO register to check whether an organisation is registered. The ICO says it publishes the controller's name and address, the registration reference, the fee level, the registration date and expiry date, any other trading names, and the contact details of a data protection officer if one was given. A data protection officer's name is published only with their consent.

Two practical points follow. First, if you work from home, the address you give will be visible. Second, anyone can check that you have paid, so keep your entry current when you renew.

The register can also be downloaded as a dataset. The ICO recommends searching by registration reference, or by postcode if you do not have it.

Paying the fee is only the first step

The fee does not make your practice compliant. Even practitioners who are exempt from the fee must meet their other obligations. The ICO's exemptions page says so directly: "you still need to comply with your other data protection obligations."

For a counselling or therapy practice, those obligations include a clear privacy notice, a lawful basis for health data, a retention policy, secure storage, and a written contract with every provider that handles client data for you. That last point applies to cloud storage, email, video platforms and any AI note-taking tool. Ask each provider, Delta included, for its data processing agreement before you use it.

Our UK GDPR checklist for counsellors walks through each of these items. If you are weighing up AI tools, our article on professional confidentiality and AI covers the questions to ask, and our guide to health data hosting explains what certified hosting means.

How Delta handles client data

Delta is an AI assistant for mental health and allied health practitioners. During the session, Delta transcribes what is said, then prepares a session report that you review. You can also dictate observations right after the session, or add written notes. The report is added to the client's file, so the whole follow-up sits in one place.

On security, data is hosted in France with a host certified for health data (HDS, the French health data hosting certification). AI processing, transcription included, runs on servers located in France. The client's name and identifying details are pseudonymised before AI processing, no audio file is kept, data is never used to train models, and data is encrypted in transit and at rest. Details are on the Delta security page and the page for therapists.

Using Delta does not change your own duties. You remain the controller, so you still pay your ICO fee and keep your privacy notice up to date.

Sources

• Data Protection (Charges and Information) Regulations 2018, regulation 3, legislation.gov.uk
• Data Protection (Charges and Information) Regulations 2018, Schedule (exempt processing), legislation.gov.uk
• ICO, Data protection fee
• ICO, Data protection fee: tiers and amounts
• ICO, Data protection fee exemptions
• ICO, Data protection fee self-assessment
• ICO, Register (new registration)
• ICO, Pay or renew your data protection fee
• ICO, Register of fee payers
• ICO, Penalty notices issued for non-payment of fee
• BACP, FAQs about UK GDPR and DPA 2018