ICO registration for therapists: do you need to pay?
Almost every therapist in private practice has to pay the ICO's data protection fee. Here is why, how much it costs, the narrow exemptions, and how to register in about ten minutes.
By the NoteSono team · Last reviewed · 8 sources checked
The short answer
Yes, almost certainly. If you run a private practice and keep any client information electronically, including emails, phone contacts, online bookings or digital notes, you must pay the annual data protection fee to the Information Commissioner's Office.
For a sole practitioner it is £52 a year (tier 1), or £47 if you pay by direct debit. Not paying can lead to a fine of up to £4,000.
Who has to pay
The fee applies to every data controller unless all of their processing is exempt. As a therapist in private practice you decide what client information to keep and how, so you are the controller of your clients' data.
The exemptions are narrow. The one therapists most often think applies is for records that are not kept "wholly or partly by automated means". In practice that means paper only, with no client emails, no client numbers in your phone, no online diary, no invoicing software and no digital notes. BACP's own guidance on record keeping uses the example of a counsellor who decided not to register because she handwrites her notes, and treats it as a mistake, because she still receives client emails on her computer.
Paper notes are not enough
How much it costs in 2026
| Tier | Who | Annual fee | By direct debit |
|---|---|---|---|
| Tier 1: micro | Turnover up to £632,000, or 10 or fewer staff | £52 | £47 |
| Tier 2: small and medium | Turnover up to £36 million, or 250 or fewer staff | £78 | £73 |
| Tier 3: large | Everyone else | £3,763 | £3,758 |
These amounts have applied since 17 February 2025, when they rose from £40, £60 and £2,900. Articles quoting £40 are out of date. Staff include employees, workers and partners, and each part-time person counts as one.
The fee is a business expense, so you can claim it against your income for tax.
Trainees, placements, agencies and EAP work
The ICO has no guidance written for therapists, but its guidance for dental associates is a close match. You are likely to be a controller, and need to pay, if:
- you are responsible for the security of the client records
- you keep your own client list that would come with you if you left
- you would be responsible if a client complained or data was lost
If you are an employee, your employer's fee covers you. A trainee on placement whose agency keeps the records is usually covered by the agency. If you see EAP clients and also have private clients, you need your own fee for the private work anyway.
Registering and renewing
Register directly on the ICO website. The ICO warns that third-party agencies which offer to register you for a higher fee "have no official standing", so pay the ICO directly.
Every year
- Renew within 21 days of your renewal date. Direct debit does this for you.
- Update your details if your address, name or business structure changes, for example if you become a limited company.
- The ICO does not send invoices. Your confirmation email and registration certificate are your record.
Where to show your registration number
Clients and insurers increasingly look for it. Put it in your privacy notice, your contract, your website footer and your directory profiles.
What happens if you do not pay
The ICO says fines for not paying range from £400 to £4,000, on top of the fee itself. If you receive a notice of intent, the ICO says you just need to pay the fee by the deadline on the notice and you will not be fined.
Paying the fee is separate from complying with data protection law. You still need a privacy notice, secure records, a way to handle subject access requests and, since June 2026, a way for clients to make data protection complaints to you.
Common questions
Do counsellors need to register with the ICO?
Almost always. A counsellor in private practice who holds any client information electronically, including emails or phone contacts, must pay the annual data protection fee. Only practitioners whose client records are entirely on paper are exempt.
How much is ICO registration for a therapist?
£52 a year for tier 1, which covers almost all sole practitioners, or £47 by direct debit. The fees have applied since 17 February 2025.
Do I need ICO registration if I only see EAP clients?
It depends whether you control the records. If the EAP decides how records are kept and you keep none of your own, you may be covered by the EAP. If you keep your own notes and would be responsible for them, you are likely to need your own registration.
Is the ICO fee tax deductible?
Yes. It is a cost of running your practice, so you can include it in your allowable business expenses.
Is the ICO still called the ICO?
Legally, the Information Commissioner was replaced by the Information Commission on 30 September 2026. The regulator still uses the ICO name and website, and the fee works the same way.
Sources
Checked on 19 October 2026. Rules and prices change, so check the source before you rely on a figure.
- ICO: Changes to the data protection fee — new fees from 17 February 2025
- ICO: Guide to the data protection fee
- ICO: Data protection fee self-assessment
- ICO: Fee FAQs — penalties, agencies, associates
- ICO: Pay a penalty
- Data Protection (Charges and Information) Regulations 2018 — tiers and exempt processing
- BACP Good Practice in Action 065: confidentiality and record keeping
- Data (Use and Access) Act 2025 (Commencement No. 9) Regulations 2026 — Information Commission
This guide is general information, not legal advice. Use the ICO's self-assessment tool to confirm your own position.