The ICO fee for online sellers: do eBay sellers need to pay it?

Do online sellers need to pay the ICO fee?

The ICO fee for online sellers is a question many eBay sellers never think to ask. The Information Commissioner's Office (ICO) is the UK regulator for data protection. According to the ICO's page on the data protection fee, under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information must pay the data protection fee unless they are exempt.

An eBay seller uses personal information every day: buyers' names, delivery addresses, order histories and messages. So the question does apply to you. Whether you must pay depends on what you do with that information, and the ICO gives you a short self-assessment to find out.

This guide explains the general position in plain words. It is not legal advice, so use the ICO's tools and guidance for your own situation.

What personal information does an eBay seller handle?

Personal information, or personal data, is information about an identifiable living person. For a typical eBay seller, that includes:

• buyers' names and delivery addresses on orders and postage labels;
• phone numbers passed to couriers for delivery;
• messages with buyers about orders, returns and problems;
• records of who bought what, kept for accounts and returns;
• details of any staff or helpers you pay;
• images from CCTV, if you use it for the business.

Some of this lives inside eBay, but much of it ends up outside: printed labels, spreadsheets, courier accounts, email and the phone you use to message buyers. That outside copy is the part you are responsible for looking after.

Tools and apps that touch buyer data

Many sellers connect other services to their eBay account: label printing, bookkeeping, listing and repricing tools, and courier platforms. Each one may receive buyer names and addresses to do its job. Before you connect a tool, check what data it receives, where it keeps it and how you can remove it if you stop using the service. Keep a simple list of the services connected to your account and remove the ones you no longer use. That list is also the first thing you need if something goes wrong.

How do you find out if you must pay the ICO fee?

The ICO provides a self-assessment on its website that asks about how you use personal information. It takes a few minutes. Answer it honestly and keep a note of the result and the date, so you can show later that you checked.

How exemptions work

Some organisations are exempt from the fee. The ICO's guidance explains the exemptions, which depend on what you use personal information for. Some uses that are part of running almost any business, such as keeping your accounts and records, are treated differently from other uses, such as CCTV for crime prevention. The self-assessment walks through these questions, so let it decide rather than guessing.

If you need to pay

The fee depends on the size of the organisation, and the ICO sets the current amounts on its fee page. You pay online, and it is renewed periodically. Put the renewal date in your calendar, because an unpaid fee can lead to a penalty. Keep the payment confirmation with your business records.

If you trade through a limited company, the company is the organisation that pays, not you personally. Our guide to sole trader vs limited company for eBay covers the wider differences between the two.

Which data protection rules apply whether or not you pay?

The fee is only one part. Data protection law applies to how you handle personal data whatever your fee position. gov.uk's guide to data protection and your business summarises what businesses must do. For an eBay seller, the practical points are:

• Use data only for its purpose. A buyer's address is for delivering their order, handling returns and keeping your records, not for unrelated uses.
• Keep only what you need. Do not copy buyer details into extra lists or tools without a reason.
• Keep it secure. Use strong passwords and two-step sign-in on eBay, email and courier accounts, and lock the devices you use.
• Do not keep it for ever. Decide how long you need order details and delete or archive the rest.
• Respond to requests. People can ask what data you hold about them, and you need to be able to answer.
• Act on breaches. If buyer data is lost or exposed, you may need to report it to the ICO.

A worked example: one small seller's data audit

Example: suppose a hypothetical sole trader sells homeware on eBay from a spare room. Here is what a one-hour data audit might find and fix. The details are invented to show the method.

In this example none of the fixes cost money, and together they cut the seller's risk a great deal. The seller also runs the ICO self-assessment, notes the result and sets a reminder to check again if the business changes.

How does buyer data fit with your tax records?

You need to keep business records for tax, and some of them contain personal data, such as order details. That is a proper reason to keep them. The balance is to keep what your records need for as long as gov.uk requires, and no more. gov.uk explains what to keep in its guide to business records if you are self-employed.

In practice, your accounts need the order number, date, amount and what was sold. They rarely need the buyer's full address years later. Our guide to record keeping for eBay sellers shows how to set up records that serve tax without holding more personal data than you need.

Using buyer details for marketing

It can be tempting to add past buyers to a mailing list. Electronic marketing has its own rules under UK law, and eBay has its own rules on how sellers may use buyer information. Read eBay's policies and the ICO's guidance on direct marketing first. Using order details to market without the right basis can break both.

What should you do if buyer data is lost or exposed?

Mistakes happen: a phone is stolen, a spreadsheet is sent to the wrong person or an account is broken into. What matters is acting quickly and in order.

1. Contain it. Change passwords, sign out other sessions, recall or ask for deletion of a misdirected email, and lock or wipe a lost device if you can.
2. Work out what was involved. Whose data, how much, and what kind: a list of names and addresses is different from payment or identity details.
3. Assess the risk to people. Think about whether buyers could be harmed, for example through fraud or unwanted contact.
4. Decide whether to report. The ICO's guidance on personal data breaches explains when a breach must be reported to it, and the time limit for doing so. Read it as soon as you know about a breach.
5. Tell affected people where needed. If there is a high risk to them, they may need to know so they can protect themselves.
6. Record what happened. Write down the facts, what you did and why, even if you decide not to report.

Most breaches at a small eBay business come from weak or shared passwords and unlocked devices. The habits in the checklist below prevent the majority of them.

A quick checklist

• Run the ICO's fee self-assessment and save the result with the date.
• If you must pay, pay online and set a renewal reminder.
• List every place buyer data ends up: labels, spreadsheets, courier accounts, email, phone.
• Secure each one with its own password, two-step sign-in and a locked device.
• Delete or archive buyer details you no longer need.
• Keep a short note of what data you hold, why and for how long.
• Re-run the self-assessment when your business changes, for example if you hire staff or install CCTV.