English

Türkçe
O‘zbekcha
Русский
Español

English

Türkçe
O‘zbekcha
Русский
Español
Book a demo

Updated

Data protection: the ICO fee, CCTV, customer data ​

A restaurant or takeaway handles more personal information than it might think: names, phone numbers and addresses from orders and bookings, staff records, and, if you have cameras, CCTV footage. Data protection law applies to all of it, and one rule catches many small businesses: a CCTV camera for crime prevention means you must pay the ICO’s annual fee. This guide covers the UK. Since 30 September 2026 the regulator has been the Information Commission; its office is still called the ICO.

The data protection fee ​

Every organisation that uses personal information, sole traders included, pays an annual data protection fee to the ICO, unless it is exempt.

Exempt are businesses that use personal information only for staff administration, advertising and marketing their own business, and keeping accounts and records.

CCTV takes you out of the exemption. The ICO says that any business using CCTV for crime prevention must pay the fee, whatever else it does. For anything else, the ICO’s registration self-assessment tells you whether you need to pay. Even an exempt business must follow the rest of data protection law.

How much, since 17 February 2025:

TierWhoFee a year
1turnover up to £632,000, or no more than 10 staff£52
2turnover up to £36 million, or no more than 250 staff£78
3everyone else£3,763

Paying by direct debit takes £5 off. The fee covers 12 months and is renewed every year. Not paying can mean a fine of up to £4,350.

CCTV in a restaurant or takeaway ​

The ICO has a checklist for small systems like a shop or café’s. In short:

  • A clear reason. Define the problem the cameras are there to solve, such as preventing and detecting crime or keeping people safe, record your lawful basis, and name one person as responsible for the system.
  • Signs. Put up visible signs that CCTV is in use, with contact details if it is not obvious who runs it.
  • Point it at your premises. Position cameras so they do not capture private land or people who are not visiting you. The ICO’s own example is a café whose camera caught a nearby flat and had to be adjusted.
  • Sound off. If the system can record sound, turn that off unless you can clearly justify it.
  • Keep it only as long as you need it. There is no fixed period: your purpose decides it. Not six months just because the recorder allows it.
  • Lock it down. Only a few named people should be able to see the footage, and it should be stored securely.
  • Requests for footage. Someone who asks for footage of themselves is making a subject access request: you must respond within one month, and should stop the footage being deleted while you deal with it. Giving footage to the police is usually appropriate when the system is there to prevent and detect crime.
  • Staff. If cameras also watch your team, tell staff what is monitored and why, and do a data protection impact assessment first. Monitoring workers in secret is only justified in very exceptional circumstances.

Customer details from orders and bookings ​

The ICO’s principles for small businesses come down to a few habits:

  • Only collect what you need. A delivery needs an address; a booking needs a name and a phone number.
  • Tell people why. Explain in a privacy notice what you collect and why, and that they can complain to you and to the ICO.
  • Keep it safe and only as long as you need it, then delete it.
  • Information about someone’s health is a special category of data under the law, and needs extra care.

A complaints procedure, since 19 June 2026. Every organisation must make it easy to complain about how it uses personal information, for example with a form that can be filled in online. You must acknowledge a complaint within 30 days and deal with it without undue delay.

Marketing emails and texts ​

You cannot simply text an offer to everyone who has ever ordered.

  • Consent: a clear opt-in. Pre-ticked boxes, silence or doing nothing do not count.
  • The soft opt-in lets you email or text existing customers without asking first, but only if: you got their details when they bought, or asked about buying, from you; you are marketing your own similar products; you gave them a chance to opt out when you took their details; and you give them one in every message.
  • Every message needs a free, simple way to opt out.
  • A bought list of contacts does not qualify for the soft opt-in.

If data is lost or stolen ​

A personal data breach can be personal information sent to the wrong person, a phone or laptop with it on lost or stolen, or someone getting access who should not have it.

  • Report it to the ICO within 72 hours of finding out, unless it is unlikely to put anyone at risk.
  • Tell the people affected without undue delay if the risk to them is high.
  • Keep a record of every breach, including the ones you did not need to report.

A short checklist ​

  • Check whether you need to pay the data protection fee. With CCTV, you do.
  • CCTV: a defined reason and a named person responsible, signs, sound off, short retention, few people with access.
  • A privacy notice for customers, saying they can complain.
  • A way to receive complaints, acknowledged within 30 days.
  • Marketing only with consent or a proper soft opt-in, and an opt-out in every message.
  • Know what to do in a breach: 72 hours to report.

Sources ​

This guide is general information, not legal advice. For your own business, see the ICO’s advice for small organisations or ask a data protection adviser.