Registering a UK startup with the Information Commissioner’s Office: a practical guide

Why ICO registration matters

If your startup handles personal data, you almost certainly need to register with the Information Commissioner’s Office (ICO) and pay a data protection fee. This is not optional for most businesses. It’s a legal requirement under the Data Protection (Charges and Information) Regulations 2018. The ICO is the UK’s independent regulator for data protection rights.

Many founders treat this as a tick-box exercise. It is, but getting it wrong can lead to fines. The ICO regularly publishes details of organisations that have been fined for failing to register. You do not want your startup’s name on that list when an investor, customer, or potential employee searches for you.

Who needs to register

The test is straightforward. You must register unless you are exempt. Exemptions are narrow.

You do not need to register if you only process personal data for one or more of the following purposes:

• Staff administration (payroll, HR records, pensions)
• Advertising, marketing, and public relations for your own business
• Accounts and records (invoicing, bookkeeping)
• Not-for-profit purposes (for charities and some voluntary organisations)
• Maintaining a public register (where the law requires you to)
• Processing personal data without a computer (manual records only, which is vanishingly rare)

If your startup does anything else with personal data, you need to register. Common examples that remove the exemption include:

• Using CCTV for crime prevention
• Operating a website that uses cookies or analytics
• Sending marketing emails or newsletters
• Running customer accounts or loyalty schemes
• Processing data for market research services you sell
• Collecting customer details to provide a service

Most startups will fall outside the exemption because they have a website with analytics, send marketing communications, or collect customer data beyond basic accounting. If you are unsure whether you qualify for an exemption, take the ICO’s self-assessment online. It takes about five minutes. But do not guess. The regulator expects you to know your obligations.

When to register

You must register before you start processing personal data, unless an exemption applies. For startups, the logical time is immediately after incorporation and opening a bank account. You do not need a live product or paying customers. If you are testing software with real email addresses or running a landing page with a contact form, you are processing personal data.

Once registered, you renew annually. The ICO will send reminders, but you should diarise the renewal date yourself. Responsibility sits with the company, not with the regulator to chase you.

How much it costs

The data protection fee is tiered based on your organisation’s size and turnover. For most small startups, you will fall into Tier 1 (micro organisations). The current fee is £40 per year. Tier 2 (small and medium organisations) pays £60. Tier 3 (large organisations) pays £2,900. If you are a startup with a handful of employees and modest turnover, assume £40 or £60.

You can pay online by card or direct debit. Direct debit is simpler for renewals. The fee reduces to £35 for Tier 1 if you pay by direct debit.

How to register

Go to the ICO’s website and complete the online registration. You will need:

• Your company’s legal name and registration number (from Companies House)
• Your registered address and any trading address
• The number of employees
• Your turnover for the last financial year (if any)
• Details of the type of data processing you carry out
• A contact name and email address for data protection queries
• Payment details

The form asks about the nature of your processing. Keep your answers honest and straightforward. This is not the place for exhaustive detail, but you should describe what you actually do. For example: “We collect email addresses and names for account creation and email newsletters. We use cookies and basic analytics on our website.”

After payment, you will receive a registration certificate and an ICO registration number. Keep a copy of the certificate in your document hub. You may need to include your registration number on your website privacy notice.

What happens if you don’t register

The ICO is active in enforcement. If you fail to register, you can receive a formal notice requiring you to do so. Ignore that, and the ICO can issue a monetary penalty of up to £4,350. This is not theoretical. The ICO publishes a list of businesses fined for non-payment. Beyond the fine, failure to register can damage your credibility with investors, clients, and partners. It also raises questions during due diligence.

A note for startups with investors

During investor due diligence, one of the first housekeeping checks is whether your startup is ICO-registered. If you are not, and you should be, it signals poor operational hygiene. Fixing it late is possible, but it’s better to start out compliant.

Work this into your compliance rhythm

Once registered, set a calendar reminder for renewal. Pair it with your confirmation statement filing or your annual accounts deadline so it becomes part of your natural annual rhythm. Add your registration number to your privacy notice and check that any third-party services you use are also compliant. If you change your activity significantly, review your registration to ensure it still accurately describes your processing. You can update your details on the ICO portal at any time.

This piece does not constitute legal advice. If you are unsure whether your specific processing activities fall within an exemption, speak to a solicitor or a qualified data protection practitioner. Getting this right early is a small discipline that protects your startup’s reputation and keeps you on the right side of the regulator.