Do I have to register with the ICO if I am practising as a private GP?
Who pays the ICO data protection fee, how much it costs, how practising privileges and locum work change the answer, and what paying does not cover.
The short answer
Yes, if you decide how your private patients’ records are kept and used, you are a data controller and must pay the ICO data protection fee. At the time of review that was £52 a year for most solo GPs and small practices, or £78 for larger ones. If you are employed by a clinic or online provider that controls the records, its fee covers you, and under practising privileges it depends on who controls the records.
Key points
- Under the Data Protection (Charges and Information) Regulations 2018, controllers must pay a fee to the ICO unless exempt. Holding patient records is not an exempt purpose.
- Since 17 February 2025 the fee has been £52 (tier 1), £78 (tier 2) or £3,763 (tier 3), with £5 off for direct debit.
- The legal entity that controls the records pays. A limited company pays its own fee, separate from anything you pay personally.
- Employees are covered by their employer. For locums and practising privileges, it depends on who controls the records.
- Paying the fee is not the same as complying with UK GDPR. You also need a privacy notice, security, breach handling and, since June 2026, a data protection complaints process.
The rule
Strictly, the ICO no longer runs a registration scheme. Since 2018 the Data Protection (Charges and Information) Regulations have required every organisation or sole trader that processes personal data as a controller to pay an annual data protection fee, unless an exemption applies. The ICO publishes a public register of fee payers, which is why people still talk about registering.
A controller is whoever decides why and how personal data is processed. The exemptions cover narrow purposes such as staff administration, advertising your own services and keeping accounts. Holding medical records is not one of them. The ICO’s guidance for health says plainly that a medical practice holding records about its patients must pay. Processing that is entirely manual is also exempt, but a practice that uses electronic records, online booking or email about patients is not in that position.
How much it costs
| Tier | Who | Fee from 17 February 2025 |
|---|---|---|
| 1 (micro) | Turnover up to £632,000 or no more than 10 staff | £52 |
| 2 (small and medium) | Turnover up to £36 million or no more than 250 staff | £78 |
| 3 (large) | Everyone else | £3,763 |
You get £5 off if you pay by direct debit. “Staff” is defined broadly and includes employees, workers, office holders and partners, averaged over your financial year, with each part-timer counting as one. The ICO treats you as tier 3 until you tell it otherwise, so complete the tier questions carefully. Most solo private GPs and small practices fall into tier 1. The fee is annual, so set up a renewal reminder or a direct debit.
Who pays in common private GP set-ups
| How you work | Who pays |
|---|---|
| Your own practice as a sole trader | You |
| Your own practice as a limited company | The company. A company is a separate legal entity and pays its own fee. |
| A partnership | Usually the partnership. If each partner controls their own patients’ records and would take them on leaving, each partner pays. |
| Employed by a clinic or online provider | The employer. You are covered by its fee. |
| Sessional or locum work in someone else’s service | It depends on who controls the records. The ICO says this turns on your relationship with the practice. |
| Practising privileges at a private hospital or clinic | It depends. If you hold your own records about your own patients, you are likely to be a controller and should pay. If all records are the host’s, it may be the host alone. |
The ICO suggests asking questions like these to decide whether you are a controller. Do you control the patient records? Would the patients follow you if you left? Would you be legally responsible if a patient complained or data was lost? A yes to any of them points to you being a controller. Many private hospitals require doctors with practising privileges to hold their own fee, so ask the host what it expects. If you are unsure, use the ICO’s self-assessment tool.
A few other activities also trigger the fee, even outside your clinical work, such as writing medico-legal reports or using CCTV at your premises for security.
How to pay
- Use the self-assessment on the ICO website to confirm you need to pay and your tier.
- Pay online in the name of the correct legal entity, the company if you trade through one.
- Choose the health sector option that fits. There is one for GPs.
- Keep the registration number. Add it to your privacy notice, and have it ready for your CQC application and for any hospital or clinic you work with.
Fees and ICO registration apply across the UK, so the rules are the same in Scotland, Wales and Northern Ireland.
If you do not pay
Not paying when you should is a breach of the regulations, and the ICO can issue a fixed penalty set according to your tier. It usually sends a notice of intent first, which gives you the chance to pay before a penalty is issued. It is cheaper to pay the fee.
Paying the fee is not compliance
The fee is a small administrative duty. The real obligations come from UK GDPR and the Data Protection Act 2018. Health data is special category data, so you need both a lawful basis and a condition for processing it. As a private GP you also need:
- a privacy notice that tells patients what you hold, why, who you share it with and how long you keep it
- appropriate security, including for email, messaging and any cloud systems, and contracts with suppliers that process data for you
- a way to handle subject access requests, usually within one month
- a process for recording breaches and reporting serious ones to the ICO within 72 hours
- a data protection impact assessment for higher-risk processing, such as a new online service
- since 19 June 2026, under the Data (Use and Access) Act 2025, a way for people to complain to you about data protection. You must acknowledge a complaint within 30 days, investigate it and tell them the outcome.
These are covered in more detail in GDPR compliance in private practice. If you want to use NHS services such as NHSmail, you may also need the Data Security and Protection Toolkit. See can I use NHSmail as a private GP?
Frequently asked questions
I already pay the ICO fee through my NHS practice. Does that cover my private work?
Only if the NHS practice is the controller of your private records, for example because it runs the private service. If you or your own company run the private work, that entity needs its own fee.
Do I need a data protection officer?
UK GDPR requires one where your core activities involve large-scale processing of special category data. The GDPR recitals say that processing patients’ data by an individual doctor should not be treated as large scale, but a larger or online service should assess this and record its decision.
Is the ICO fee tax deductible?
It is a business expense of running your practice, so it is normally deductible. Check with your accountant for your circumstances.
Can patients check whether I have paid?
Yes. The ICO publishes a register of fee payers that anyone can search by name or registration number.
