ICO research finds smaller businesses still unaware of registration fees

The Information Commissioner's Office (ICO) has published the findings of its latest Data Controller Study, an annual research initiative launched in 2023 to support regulatory and strategic activities. This year's study featured a quantitative survey of a representative sample of 2,292 organisations that collect, process, and store personal data, with results compiled alongside those from previous years into a findings report and dashboard. The research also included 20 in-depth qualitative interviews with micro-organisations and sole traders who were previously unaware of the ICO. 

Key qualitative findings revealed that these small data controllers have limited engagement with regulators, expecting contact only if compliance issues arise. Awareness of data protection legislation was low, with businesses relying on a common-sense approach and viewing formal regulations as having limited relevance to their operations. As a consequence, many felt confident in their data handling despite having few protection measures in place.

Furthermore, interviewees were unaware of the ICO's registration requirements and fees, regarding them as a low priority. The report concluded that direct, accessible, and low-time-investment proactive engagement is necessary to educate small businesses and overcome barriers regarding their data protection obligations.

Also included in the supporting documentation are:

• Technical report
• Data tables
• Raw data

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.