ICO proposes revised data protection fee model after consultation

Recommendations include lower mid-tier costs and exemptions for charities ahead of possible 2027 implementation

The Isle of Man’s Information Commissioner (ICO) has set out revised proposals for data protection registration fees, following a public consultation on potential changes to the current system.

The data regulator says any new fee structure would not come into force until the 2027/28 financial year, with legislative changes required before implementation.

Fees have not been updated since 2011, prior to the introduction of the Applied GDPR.

The consultation explored moving to a tiered model based on the size and risk profile of organisations, bringing the Island in line with systems already used in Jersey, Guernsey and the UK.

A total of 81 responses were received, with broad support across all five consultation questions. More than 90 percent of respondents agreed that larger organisations should pay more than smaller ones, while over four in five supported exempting charities and non-profit organisations from fees.

Two thirds backed a proposed £300,000 annual fee for the Isle of Man public sector.

However, written responses also highlighted areas for improvement, particularly around how the tiers were structured. Concerns were raised that basing fees solely on employee numbers did not fully reflect data risk, and that the jump between fee bands was too steep for medium-sized organisations.

In response, the ICO has proposed revised fee levels:

Organisations with fewer than 10 employees would continue to pay £75, while those with between 11 and 49 employees would see a reduced fee of £90, down from the originally proposed £150.

Larger organisations with 50 or more employees would pay £1,900, instead of the previously suggested £2,400.

Businesses with an annual turnover of more than £2 million would automatically fall into the highest fee band, which represents around nine percent of businesses on the Island.

Charities and non-profits would be exempt from registration fees, even where they operate CCTV systems.

The ICO has also proposed that individuals required to register domestic CCTV systems that capture areas beyond their property boundary should not be charged.

The £300,000 public sector group fee would remain as proposed, although it would be subject to review.

The recommendations have now been submitted to Treasury, with a request to bring forward the necessary legislative changes.

Information Commissioner Dr Alexandra Delaney-Bhattacharya says: “We are grateful to all those who took the time to participate in the consultation and share their views.

“We have carefully considered and listened to all feedback received. Even through there is agreement with the proposals, we received detailed and useful written responses we want to take into account.

“Particularly concerns about relying solely on headcount to better account for data risk and the sharp jumps between tiers which could impact medium sized businesses. We are therefore recommending reduced fee amounts and introducing a new turnover threshold.

“The Isle of Man’s data adequacy status is crucial to the Manx economy, enabling seamless data flows to the UK and Europe without requiring additional red tape.

“To preserve this status, we must be funded in a way that allows my office to deliver robust and independent regulation without over reliance on government funding.”