Not necessarily. Under UK law you must pay the ICO data protection fee unless all of the personal data you process falls into a list of exempt processing, and that list includes a not-for-profit exemption covering most routine club admin. If that is all you do, you are probably exempt. If you also do something outside the list, such as running a CCTV system, you may have to pay, and the current fee for a small organisation is £52 a year (£47 by direct debit).
This is general information, not legal advice. The ICO's own self-assessment is the safest way to confirm your position, and it takes about ten minutes.
The rule in one paragraph
The fee comes from the Data Protection (Charges and Information) Regulations 2018. Regulation 2(1) says a data controller must pay the charge and give the ICO some basic information unless all of the processing of personal data they undertake is exempt processing. A "data controller" simply means the organisation deciding why and how personal data is used. Your club, society, charity or community interest company is the controller of its own membership list, so the question applies to you. It applies across the UK, including Scotland and Northern Ireland.
What the fee is now
Regulation 3 sets three tiers. These are the amounts in force since 17 February 2025:
| Tier | Who | Annual charge |
|---|---|---|
| Tier 1 (micro) | Turnover of £632,000 or less, or 10 or fewer staff, or a charity | £52 |
| Tier 2 (small and medium) | Not in tier 1, and turnover up to £36 million or up to 250 staff | £78 |
| Tier 3 (large) | Everyone else | £3,763 |
Paying by direct debit reduces the charge by £5. Turnover and staff numbers are measured on the first day of the charge period. For this purpose "charity" means a charity under the Charities Act 2011 in England and Wales, a body entered in the Scottish Charity Register, or a charity under the Charities Act (Northern Ireland) 2008. So a club that is not a registered charity usually lands in tier 1 on turnover or staff numbers anyway.
Note that these tiers decide how much you pay if you have to pay. They are not themselves an exemption.
The not-for-profit exemption, in the law's own words
The list of exempt processing is in the Schedule to the regulations. The one clubs rely on is paragraph 2(2)(g): processing carried out by a body or association which is not established or conducted for profit and which carries out the processing for the purposes of establishing or maintaining membership or support for the body or association, or providing or administering activities for individuals who are either a member of the body or association or who have regular contact with it.
Several other items on the same list matter to clubs and small organisations:
- administration of your own staff and volunteers (paragraph 2(2)(d));
- advertising, marketing and public relations for your own business or activity (2(2)(e));
- keeping accounts and records of transactions, deciding whether to accept someone as a customer or supplier, and financial forecasts (2(2)(f), with limits); and
- processing that is not done by automated means and is not recorded with the intention that it be (2(2)(a)). A paper-only list in a filing cabinet, for example.
The key words are "all of the processing". If every kind of personal data processing you do fits one of these descriptions, you are exempt. If one does not, the exemption does not cover you for that part, and you would pay the fee.
Where clubs trip up
The exemption is written around running the club and its members. The usual things that sit outside the list:
- CCTV or similar that records identifiable people. It is not one of the listed descriptions, so a club with a CCTV system should not assume it is exempt. Use the self-assessment.
- Processing for purposes unrelated to membership or activities, such as operating a separate trading business that handles customers' data beyond ordinary accounts.
- Not being "not for profit". The exemption is for a body that is not established or conducted for profit. A club that distributes surpluses to individuals, or a company that is run for private gain, needs to think hard. Whether a community interest company counts is a question to put through the ICO's self-assessment; we have not found an ICO statement that settles it either way.
When in doubt, do the self-assessment. It asks you about each kind of processing and tells you whether you need to pay and how much.
Worked examples
These are illustrations, not rulings. Your own answers to the self-assessment decide.
An allotment society keeps a plot-holder list (names, plot numbers, emails) in a spreadsheet and emails them about meetings and waiting-list news. That is establishing and maintaining membership and administering activities for members, so it fits the not-for-profit exemption. If it also has a website contact form and takes payments through a third-party provider, the form enquiries and the accounts records are still ordinary club admin. Likely exempt, assuming no CCTV and no unrelated processing.
A community interest company running a cafe employs staff, takes orders, keeps accounts and perhaps has a loyalty list. Staff admin and accounts are on the exempt list, and marketing for its own cafe is too. The harder question is whether a CIC counts as "not established or conducted for profit". Because a CIC is a company that can issue shares and pay capped dividends in some structures, run the self-assessment rather than assuming. If it also has CCTV in the cafe, that points towards paying.
A youth football club keeps registrations for players, parents' contact details and coaches' details, runs fixtures and sends match information. That is membership and activity administration, plus volunteer and staff admin. It is the kind of processing the exemption was written for. If the club also records training sessions on cameras for coaching feedback and keeps the footage, or runs CCTV at its clubhouse, check that processing separately. The club is also handling children's data, which makes a good privacy notice and photo consent process more important, whatever the fee position. See our guide to membership form wording that meets UK GDPR.
Exemption does not mean no data protection
This is the point to get right. Being exempt from the fee does not exempt you from UK GDPR. You still need a lawful basis for what you do, to tell people what you do with their data, to keep it secure, to keep it no longer than needed, and to respond when someone asks what you hold on them. The fee is a registration and funding mechanism for the regulator, nothing more.
Your privacy notice should look the same whether you pay or not. At minimum it names your organisation and a contact, says what you collect and why, who you share it with, how long you keep it, and what rights people have, including the right to complain. Our free privacy policy template covers these, and the plain-English GDPR guide explains why each part is there. Charities also have separate website duties, covered in UK charity website legal requirements, and CICs can see what a CIC website must show.
How to pay or confirm
- Start the ICO self-assessment (link below). It tells you whether you need to pay and how much.
- If you do, pay on the ICO site. Direct debit takes £5 off.
- Diarise the renewal: the charge period is 12 months, and you must pay and give your details within the first 21 days of each charge period.
- Whatever the answer, save a note of the date you did the check and the result, in case a new committee asks.
The ICO was replaced as a legal body by the Information Commission on 30 September 2026 and keeps the ICO name for day-to-day purposes; the regulations now name the Commission as the payee.
Where Natterio fits
Natterio sites are UK-hosted, every site has a contact form and cookie consent, and you can add your privacy page to the footer in minutes. Whether you owe the ICO fee depends on your organisation's processing, not on which website builder you use, and Natterio cannot decide that for you or make you compliant. The free plan is permanent (three pages, no card) and paid plans start at £7 a month. Build your club's site free.
Sources and last checked 30 Oct 2026
- The Data Protection (Charges and Information) Regulations 2018, regulations 2 and 3 (as amended, including by SI 2025/63 and the 2026 Information Commission changes): legislation.gov.uk/uksi/2018/480/regulation/3 and regulation 2
- The same Regulations, Schedule (exempt processing): legislation.gov.uk/uksi/2018/480/schedule
- ICO, Data protection fee self assessment: ico.org.uk self-assessment
- ICO, Data protection fee: ico.org.uk/for-organisations/data-protection-fee
- CIC Regulator guidance (CICs can issue shares and are subject to a dividend cap): gov.uk CIC guidance
- Commentary on the ICO becoming the Information Commission on 30 September 2026 (secondary source; the statutory text above already names the Commission): Lewis Silkin