Every clinic and brand that holds patient records, on a screen or on paper, is almost certainly a data controller under UK GDPR. Controllers have to notify the Information Commissioner's Office (ICO) and pay an annual fee, and the amount depends on the size of the organisation paying it, not the size of its patient list. It is one of the smaller jobs on a telehealth operator's compliance calendar, and one of the easiest to let lapse.
What the data protection fee actually is
The data protection fee is set out in the Data Protection (Charges and Information) Regulations 2018, and it funds the ICO's regulatory work: enforcement, guidance, and the public register of fee payers that anyone can search. It is separate from, and far smaller than, any penalty the ICO can issue for a breach or for failing to register at all.
It is also separate from the cost of handling a subject access request, which an organisation generally cannot charge for. The fee is a flat registration cost for the right to process personal data as a controller, paid once a year, regardless of how many requests or records pass through the business in that time.
Who actually has to pay it
Most telehealth clinics and brands are controllers because they decide why and how patient data is processed, even where PExpo or another platform does the processing on their behalf. Using a booking system, an electronic patient record, or a CRM to hold patient details counts as processing personal data by automated means, which is the trigger for the fee.
The exemptions are narrow and rarely apply to a commercial telehealth service: processing solely for staff administration, or keeping only paper records with no computer involved anywhere in the business, are the two most common. Working out lawful basis and exemptions properly sits alongside the wider UK GDPR groundwork a telehealth operator needs before it processes a single patient record.
The three fee tiers, and how to work out which one applies
The fee sits in one of three tiers, and the tier is set by the controller's annual turnover and number of staff, not by how many patients it treats. The ICO publishes a short self-assessment tool that walks through the criteria and confirms the tier, which is the only reliable way to check the current figure rather than relying on a number quoted elsewhere.
- Tier 1 covers the smallest organisations, typically micro-businesses by turnover or staff count, and carries the lowest flat fee.
- Tier 2 covers small and medium organisations, a band most independent clinics and early-stage brands will fall into.
- Tier 3 covers large organisations, and the fee rises sharply, into four figures, at this tier.
A small group running several white-label brands can end up with more than one entity in Tier 2 rather than one entity in Tier 3, which is worth checking rather than assuming.
The data protection fee is based on the size of the organisation paying it, not the size of its patient list. A two-person clinic and a 200-location operator sit in different tiers for exactly that reason.
Why a white-label brand cannot piggyback on PExpo's registration
Under PExpo's data processing agreement, PExpo acts as the processor and the clinic or brand is the controller. That split matters here: the ICO fee and registration follow the controller, not the processor, so each clinic or brand needs its own entry on the register, even where several brands run on the same underlying platform.
The same logic applies as a group grows. If a brand spins out a second trading entity, perhaps for a new vertical or a new market, that entity is very likely its own controller and needs its own registration, rather than simply being added under the parent company's existing one.
What happens if a business gets this wrong
The ICO can take enforcement action against a controller that processes personal data without paying the fee or notifying the register, including a monetary penalty that sits on top of the unpaid fee itself, not instead of it. Non-payment is also visible: the public register shows who is and is not currently registered.
Registration should happen before commercial processing starts, not retrospectively once a clinic or brand is already live. The ICO sends renewal reminders to the contact listed on the register, so an out-of-date contact detail is a quiet way for a renewal notice to go unseen.
The fee is one of the cheapest line items on a telehealth operator's compliance calendar. Missing it is one of the easiest ways to end up on the ICO's enforcement list for something that has nothing to do with clinical care.
Getting the registration right, practically
The process itself is short once an organisation knows which tier it sits in. A simple annual routine keeps it from becoming a last-minute scramble.
- Confirm the legal entity's status as a controller for each brand or clinic separately.
- Run the ICO's self-assessment tool to confirm the correct tier and current fee.
- Register and pay online, keeping the confirmation with the rest of the compliance file.
- Nominate a named contact, ideally the same person who owns the wider data protection impact assessment work, and keep that contact detail current.
- Put the renewal date in a shared compliance calendar rather than relying on the ICO's reminder alone.
- Update the register entry whenever the trading name, address, or contact changes.
Where PExpo's compliance layer helps, and where it does not
PExpo's onboarding checklist for new clinics and brands flags the ICO fee as a must-do item, alongside the lawful basis and DPIA work that sits in the same compliance file, and the DPA makes clear which party holds which obligation from day one.
What the platform cannot do is register or pay on a controller's behalf. Like records retention or CQC registration, the ICO fee is a controller-level obligation. PExpo's dashboards and audit trails support the evidence a controller needs to show it is meeting that obligation, but the registration itself stays with the clinic or brand.
The ICO data protection fee rarely makes anyone's top five compliance risks, which is exactly how it ends up missed. Treat it as part of the same annual routine as the lawful basis work and a current DPIA, check the current tier through the ICO's own tool rather than a number quoted secondhand, and make sure every brand or clinic entity in the group has its own registration, not a borrowed one.
Frequently asked questions
Does PExpo pay the ICO fee on behalf of clinics and brands?
No. Under the data processing agreement, PExpo is the processor and the clinic or brand is the controller, so the registration and the fee sit with the controller, not the platform. Each brand or clinic entity needs to check and pay its own fee.
How much is the ICO data protection fee?
It depends on which of the three tiers an organisation falls into, based on turnover and staff numbers rather than patient volume: a flat, modest amount at the smallest tier, rising to a four-figure sum for large organisations. Check the ICO's current fee table or self-assessment tool directly rather than relying on a figure quoted elsewhere, since the amounts are set by regulations and reviewed periodically.
What happens if a telehealth business processes data without paying the fee?
The ICO can take enforcement action against a controller that has not registered or paid, including a monetary penalty in addition to the unpaid fee itself. The public register also shows which organisations are currently registered, so non-payment is visible beyond the ICO's own records.
