Controllers must pay the annual data protection charge set by regulations under section 137 (the Data Protection (Charges and Information) Regulations 2018, amended with effect from 17 February 2025 to GBP 52 for tier 1 micro organisations, GBP 78 for tier 2 small and medium organisations and GBP 3,763 for tier 3 large organisations, reduced for direct debit), unless all their processing is exempt processing, and must provide the information the regulations require to determine the tier. Failure to pay is the fourth type of enforcement failure (section 149(5)) and may attract a fixed penalty of up to 150 percent of the highest charge (section 158).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.