Do you need to register under the GDPR? Records, DPOs and the UK fee

The short answer: in the EU, there is no general register to sign up to. The GDPR abolished the old duty to notify data processing to the authorities (recital 89) and replaced it with a duty to document: most businesses must keep a record of processing activities (Article 30), even with fewer than 250 employees, and some must appoint a data protection officer whose contact details go to the supervisory authority (Article 37). The UK is different. Under the Data Protection (Charges and Information) Regulations 2018, organizations that process personal data pay an annual data protection fee to the regulator unless all of their processing is exempt, and the regulator publishes a register of fee payers. The fee is currently £52, £78 or £3,763, depending on size.

EU: no register, but a duty to document

Under the old Data Protection Directive (95/46/EC), controllers generally had to notify their processing to the supervisory authorities. Recital 89 of the GDPR explains that this general obligation to notify created administrative and financial burdens without always improving protection, so it was abolished in favor of rules that focus on high-risk processing.

What replaced it is Article 30(1): each controller must "maintain a record of processing activities under its responsibility." The record must be in writing, which includes electronic form (Art. 30(3)), and you must make it available to the supervisory authority on request (Art. 30(4)). If you process data on behalf of other businesses, for example as an agency or a software provider, you also keep a shorter processor record (Art. 30(2)).

The "fewer than 250 employees" exemption and its limits

Many small businesses assume they are exempt. Article 30(5) reads in full:

"The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."

The exemption is much narrower than it looks. In a position paper endorsed by the European Data Protection Board, the Article 29 Working Party (the Board's predecessor) set out how to read it:

• The three exceptions are alternatives. Any one of them on its own triggers the obligation.
• "Risk" means any risk to people's rights, not only a high risk.
• A small organization that regularly processes data about its employees cannot treat that processing as occasional, so it must be recorded.
• On the other hand, you only need to record the processing that falls under one of the exceptions. Truly occasional, low-risk processing without special categories of data can stay out.

The UK regulator, the ICO, takes the same approach for the UK GDPR, whose Article 30(5) has the same wording. In practice, if you handle customer orders, supplier contacts or payroll every month, those activities are not occasional and belong in your record.

What goes in the record?

Under Article 30(1), a controller's record contains:

• the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer,
• the purposes of the processing,
• a description of the categories of data subjects and of the categories of personal data,
• the categories of recipients, including recipients in third countries or international organizations,
• where applicable, transfers to a third country or an international organization, naming that country or organization,
• where possible, the envisaged time limits for erasing the different categories of data,
• where possible, a general description of your technical and organizational security measures.

A well-kept spreadsheet can meet the "in writing, including in electronic form" requirement. Much of the content overlaps with your privacy notice (purposes, recipients, transfers, retention), so build the two together and keep them consistent. Infringing the controller obligations in Articles 25 to 39, which include Articles 30 and 37, can lead to fines of up to EUR 10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4)(a)).

Do you need a data protection officer?

Under Article 37(1), a data protection officer (DPO) is mandatory only where:

• (a) the processing is carried out by a public authority or body,
• (b) your core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale, or
• (c) your core activities consist of large-scale processing of special categories of data or of data relating to criminal convictions and offences.

Most small businesses whose core activity is selling products or services will not meet these tests, but a business built on tracking people's behavior or on health data may. National law can require more (Art. 37(4)). In Germany, for example, a DPO is required where as a rule at least 20 persons are constantly engaged in the automated processing of personal data (Federal Data Protection Act, BDSG, section 38(1)). Check the rules of the country where you are established.

If you have a DPO, you must publish their contact details and communicate them to the supervisory authority (Art. 37(7)). In the EU, this is the closest thing to a registration step.

UK: the data protection fee

The UK GDPR contains Articles 30 and 37 in essentially the same form as the EU text. On top of that, section 137 of the Data Protection Act 2018 allows the government to require controllers to pay charges to the regulator, and the Data Protection (Charges and Information) Regulations 2018 do so. Unless all of your processing is exempt, you must pay the charge and provide some basic information within the first 21 days of each 12-month charge period: your name and address, your staff band, your turnover band and whether you are a public authority (reg. 2).

The word "or" matters: meeting either criterion puts you in the lower tier. Turnover and staff numbers are taken on the first day of the charge period, and "members of staff" include employees, workers, office holders and partners (reg. 1(2) and 3(4)). Paying by direct debit reduces the fee by £5 (reg. 3(5)). These amounts have applied since February 17, 2025.

Who is exempt?

You are exempt only if all of your processing falls within the descriptions in the Schedule to the Regulations. Those most relevant to small businesses are:

• administration of your staff, volunteers and contractors,
• advertising, marketing and public relations for your own business, goods or services,
• keeping accounts and records of purchases, sales or other transactions, deciding whether to accept someone as a customer or supplier, and making financial forecasts (processing of data by or obtained from a credit reference agency does not count here),
• processing that is not carried out by automated means,
• certain membership and support processing by not-for-profit bodies.

A single activity outside these descriptions is enough to make the fee payable. The ICO's FAQ gives a common example: any business using CCTV for crime prevention has to pay. The ICO's online self-assessment tells you whether you need to pay and which tier applies. If your business is established outside the UK, whether the fee applies depends on the territorial scope of UK data protection law, so start with that self-assessment.

What happens if you do not pay?

The regulator can impose a fixed penalty. Section 158(3) of the Data Protection Act 2018 caps it at 150% of the highest charge, disregarding any discount; the ICO's FAQ states that fines range from £400 to £4,000. The ICO also publishes a register of fee payers showing the controller's name and address, registration reference, fee tier, registration and expiry dates, other trading names and, if provided, the DPO's contact details.

What registration, or the lack of it, does not change

Neither the absence of an EU register nor a UK fee exemption releases you from your other obligations. You still need a lawful basis for each purpose, a privacy notice, appropriate security and a process for handling people's requests. We explain the difference between a privacy notice and consent in a separate article.

Checklist for small businesses

• List your regular processing activities (customers, prospects, suppliers, staff, marketing). If you are under 250 employees, remember that regular processing is not occasional.
• Build your record of processing with the Article 30(1) items and keep it consistent with your privacy notice.
• Check Article 37(1) and your national law to see whether you need a DPO; if you appoint one, publish the contact details and notify the supervisory authority.
• In the UK, run the ICO self-assessment. If you have to pay, note the renewal date and consider direct debit.
• Update the record whenever you add a new tool or provider: new recipients and transfers to third countries belong in it (Art. 30(1)(d) and (e)).
• Recheck when you grow: a new activity such as CCTV, or a move to a higher staff or turnover band, can change your position.

This article is for general information only and is not legal advice.