The Data Protection Act 1988 requires all data controllers to be included on a public register, subject to limited exceptions. Failure to notify is a criminal offence. As of 1 October 2009 the fees charged to data controllers to be notified on the register of data controllers will be split into two tiers.

Tier 1 includes charities, small occupational pension schemes, organisations with a turnover below £25.9 million and those with a higher turnover but fewer than 250 staff, who will continue to pay £35 annually.

Tier 2 includes organisations with 250+ staff and an annual turnover of £25.9 million or more. For public authorities only 250 or more staff is taken account, will be required to pay a £500 annual fee.

The introduction of the tiered system is to raise revenue for the Information Commissioner’s Office to support its regulatory and advisory roles. Although the Information Commissioner’s Office own research indicates that less than 4 per cent of data controllers will fall within the scope of tier two, the tier criteria were set to reflect the amount of resources invested by the Information Commissioner’s Office in regulating large data controllers.