Do courier companies need to register with the ICO?
Yes, in almost all cases. Booking a delivery involves collecting a name, address and phone number for both sender and receiver, which makes the courier a data controller under UK GDPR. The Data Protection (Charges and Information) Regulations 2018 require data controllers to pay an annual fee to the ICO and appear on its public register unless a specific exemption applies.
This series has spent the last few weeks working through the paperwork that sits around a courier business rather than the van itself: right to work checks, four kinds of insurance, and most recently what licence covers towing a trailer. There’s one more piece of paperwork that has nothing to do with vehicles at all. Every booking a same day courier takes involves someone’s name, address and phone number, usually for both the sender and the receiver. That’s personal data, and UK law has specific rules about who has to tell the regulator they’re processing it, and pay for the privilege.
Do Courier Companies Need to Register with the ICO?
Yes, in almost every case. UK GDPR and the Data Protection Act 2018 apply to any organisation that processes personal data, and a courier booking a job is doing exactly that: collecting a name, an address and a contact number for both ends of the delivery. Separately from the data protection rules themselves, the Data Protection (Charges and Information) Regulations 2018 require every data controller to pay an annual fee to the Information Commissioner’s Office (ICO) and appear on its public register, unless a specific exemption applies. Registering isn’t optional paperwork on top of GDPR compliance, it’s a separate legal requirement that funds the regulator itself.
How Much Is the Data Protection Fee?
The fee has always been set on a three tier structure, and it’s based on the size of the organisation rather than how much personal data it actually holds. GOV.UK confirms the tiers introduced in 2018 were tier 1 (micro organisations) at £40, tier 2 (small and medium organisations) at £60, and tier 3 (large organisations) at £2,900, each with a £5 discount for paying by direct debit. Those fees stayed unchanged for seven years. From 17 February 2025, the Data Protection (Charges and Information) (Amendment) Regulations 2025 increased them for the first time, following the government’s consultation on bringing the fee in line with inflation. Because the exact current fee depends on your turnover and staff numbers, the quickest way to confirm what a specific courier business owes is the ICO’s own fee self-assessment tool rather than relying on a single fixed figure.
Which Fee Tier Does a Same Day Courier Fall Into?
The tier is set by turnover or staff numbers, whichever puts the business into the higher band. Tier 1 covers organisations with a maximum turnover of £632,000 or no more than 10 members of staff. Tier 2 covers organisations with a maximum turnover of £36 million or no more than 250 members of staff. Tier 3 covers anything larger than that. Most independent same day couriers, owner-drivers and small fleets fall into tier 1, and most established regional courier operators with an office and a handful of controllers sit in tier 2. Tier 3 is really only relevant to national logistics groups.
Are Any Courier Businesses Exempt from the Fee?
A small number of exemptions exist, set out in the schedule to the Charges Regulations 2018: processing that’s entirely manual with no computer records, processing for personal or household purposes, staff administration, advertising and marketing for the controller’s own activities, and keeping accounts and financial records. None of these fit what a courier company actually does day to day. Booking a job, tracking a driver to a delivery address and keeping proof of delivery is the core of the service, not staff admin or bookkeeping, so the exemptions rarely apply. A courier business that holds no customer data at all, for example a driver working purely as a subcontractor booked and controlled entirely by someone else’s system, is one of the few realistic exceptions, and even then it’s worth checking rather than assuming.
What Happens If a Courier Company Doesn’t Register or Pay?
The ICO can issue a fixed penalty for non-payment, capped by regulation at 150% of the top tier fee. It also publishes both a register of penalty notices issued for non-payment and a public register of fee payers that clients and larger businesses sometimes check before awarding contract work. None of this replaces the underlying data protection obligations either. A courier that’s exempt from paying the fee, or simply hasn’t registered, still has to handle personal data lawfully, keep it secure and delete it when it’s no longer needed. The fee funds the regulator; UK GDPR itself applies regardless of whether a fee is due.
What Personal Data Do Same Day Couriers Actually Handle?
More than most businesses assume. Every job carries a sender name and address, a receiver name, address and phone number, and usually a signature or photo captured as proof of delivery. Some work goes further: our NHS and healthcare courier jobs can involve specimens or documents linked to an identifiable patient, which counts as special category data under UK GDPR and needs extra care, and our legal and document courier runs often carry confidential case material. Vehicle tracking used to manage a fleet in real time also counts as personal data about the driver, not just the van. None of this needs to stop a booking moving quickly, but it’s the reason the fee and the underlying rules apply to almost every courier operation rather than just the larger ones.
A Quick Recap: Data Protection vs the Rest of the Compliance Series
Everything else in this series has been about a specific van or a specific driver: motor insurance, employers’ liability, right to work checks, licence entitlements. The data protection fee is different. It applies to the business as a whole, the same way the company’s own accounts or its VAT registration do, and it doesn’t reset when a new driver joins or a new van is added to the fleet. It’s an annual obligation that sits quietly in the background of every booking taken, which is exactly why it’s easy for a small operator to miss.
Every booking we handle is treated as personal data from the moment it’s placed to the moment it’s delivered, and our own registration is kept current every year. Call our controllers on 020 4525 2039 or get a fixed quote online.
At a Glance
| Question | Short answer |
|---|---|
| Do courier companies need to register with the ICO? | Yes, in almost all cases. |
| How much is the ICO data protection fee for a courier company? | Fees are set in three tiers based on turnover or staff numbers, originally £40, £60 and £2,900 when introduced in 2018. |
| Are any courier businesses exempt from the data protection fee? | The exemptions cover things like purely manual record keeping, staff administration and basic accounts and bookkeeping. |
| What happens if a courier company doesn't pay the data protection fee? | The ICO can issue a fixed penalty, capped by regulation at 150% of the top tier fee, and it publishes a public list of penalty notices… |
| Does the data protection fee apply to self-employed courier drivers? | It depends on who controls the data. |
Frequently Asked Questions
Do courier companies need to register with the ICO?
Yes, in almost all cases. Booking a delivery involves collecting a name, address and phone number for both sender and receiver, which makes the courier a data controller under UK GDPR. The Data Protection (Charges and Information) Regulations 2018 require data controllers to pay an annual fee to the ICO and appear on its public register unless a specific exemption applies.
How much is the ICO data protection fee for a courier company?
Fees are set in three tiers based on turnover or staff numbers, originally £40, £60 and £2,900 when introduced in 2018. These were increased from 17 February 2025 under the 2025 amendment regulations, the first change since the fee was introduced. The exact current amount for a specific business is best checked using the ICO’s online fee self-assessment tool.
Are any courier businesses exempt from the data protection fee?
The exemptions cover things like purely manual record keeping, staff administration and basic accounts and bookkeeping. Taking bookings, tracking deliveries and keeping proof of delivery records doesn’t fall under any of these, so most courier businesses need to register and pay. A driver working purely as a subcontractor with no direct access to customer data is one of the few likely exceptions.
What happens if a courier company doesn’t pay the data protection fee?
The ICO can issue a fixed penalty, capped by regulation at 150% of the top tier fee, and it publishes a public list of penalty notices issued for non-payment. Not paying the fee doesn’t remove the underlying duty to handle personal data lawfully under UK GDPR either, so the core compliance risk remains even without a fee being due.
Does the data protection fee apply to self-employed courier drivers?
It depends on who controls the data. A self-employed driver working as a subcontractor, booked and instructed entirely through a courier company’s own systems, usually isn’t the data controller for that job. A self-employed courier taking their own bookings directly from customers, with their own records of names and addresses, is acting as a data controller in their own right and needs to consider registering separately.