ICO Registration for Coaches: A Practical Guide for Coaches

ICO registration for coaches is, in practice, a yearly data protection fee. If you coach in the UK and keep any client details on a laptop, phone, calendar app or email account, you almost certainly have to pay it. For a solo coach the fee is £52 a year, or £47 if you pay by direct debit, as listed in November 2026. The only realistic way out is keeping every client record on paper and nothing else, which almost no working coach does. This applies to coaches based in the UK. If you live elsewhere and coach UK clients, your own country's rules come first, and you should check with a local adviser.

We make Coachful, a coaching platform, so we have a stake in how coaches store client data. It only comes into this question at one point: paying the fee is half the job, and the other half is keeping client notes, intake answers, agreements and payments in a place you can secure, export and clear out. Coachful puts those in one client record. We cover that near the end. Nothing here is legal advice. The rules below come from the UK legislation itself, read in November 2026, and anything specific to your situation belongs with a solicitor or a data protection adviser.

Under the law the "registration" is two duties: pay a charge and give the regulator a few facts about your business. The register people search online is a public list of the organisations that have paid. People still say "ICO registration" because that is what the old system was called, and the regulator's site is still ico.org.uk.

Do coaches really have to pay the data protection fee?

Yes, if you are a UK coach who handles client information electronically. The Data Protection (Charges and Information) Regulations 2018, regulation 2 says every data controller must pay a charge "unless all of the processing of personal data they undertake is exempt processing." A self-employed coach who decides what client information to collect and why is the data controller. So is a limited company you coach through.

The important words are "all of the processing." Paying is the default. You are exempt only if every single thing you do with personal data fits one of the exempt categories in the Schedule. As a coach, your main work is not in any of them: holding notes on a client's goals, tracking their progress and messaging them between sessions. Session notes alone usually decide it.

There is one other detail coaches often miss. On 30 September 2026 the legislation started naming the regulator the "Information Commission" instead of the Information Commissioner. That change comes from regulations made under the Data (Use and Access) Act 2025, and you can see it in the amendment notes on section 137 of the Data Protection Act 2018. You will still see "ICO" everywhere, including in this article's title, because that is what coaches search for. The duty to pay has not changed.

What is at stake if you skip it?

A fixed penalty, plus a public record showing you were not registered. Section 158 of the Data Protection Act 2018 requires the regulator to publish its penalty amounts for failing to pay. It also caps them at 150% of the highest charge payable, ignoring any discount. The highest charge is currently £3,763, which puts the legal ceiling at £5,644.50. The amount you would actually face depends on the regulator's published scale, so check the current figure on its site. Either way, it is many times the £52 you avoided.

The money is not the biggest cost. In coaching, trust is the product. Prospective clients, especially corporate buyers commissioning executive or career coaching, can check the public register before signing a contract, and supplier forms often ask for the number. A procurement form that asks for your registration number with a blank answer looks careless. A small coaching practice can easily lose a three-month engagement over it.

There is also a quieter risk. Paying the fee does not make you compliant. It only proves you know the rules exist. If a client complains that you shared their notes, or that you ignored a request for their data, the regulator will look at how you actually handled their information. A coach who never paid the fee usually turns out to have no privacy notice, no retention rule and notes scattered across six apps. The steps further down fix all of that together.

Which fee tier is a solo coach in?

Almost certainly tier 1, the micro-organisation tier. Regulation 3 puts you in tier 1 if your turnover is £632,000 or less for your financial year, or you have 10 or fewer members of staff. You only need to meet one of those tests. A practice with eight associate coaches and a turnover above £632,000 still qualifies on staff numbers.

Source: regulation 3 of the 2018 Regulations as amended from 17 February 2025, read in November 2026. The £5 direct debit reduction is in regulation 3(5). Your tier is fixed on the first day of each charge period, so if your turnover grows during the year you do not need to move tiers mid-year. You check again at renewal.

When are you exempt, and does any of it fit a coach?

Very rarely. The Schedule to the Regulations lists the kinds of processing that are exempt. Remember, you are only exempt if everything you do falls inside the list.

Many coaches think that because they only do "admin and marketing," they are exempt. The accounts exemption and the marketing exemption are real, and a bookkeeper who only does invoices might fit them. Coaching is different. Your work involves recording what a client wants to change, what they told you about their manager or their marriage, and whether they did their actions this week. None of that is accounts or advertising, so the exemption does not cover you.

The paper-only route deserves one honest sentence. If you genuinely run a tiny in-person practice with a paper diary, paper notes in a locked drawer, cash or bank transfers recorded in a ledger, and no client emails, you may not need to pay. Almost no one coaching in 2026 works like that. If you are not sure, the regulator's self-assessment on its fee page asks the questions one at a time.

What information do you have to give when you register?

Very little. Regulation 2(3) lists it. The regulator needs:

• Your name and address. For a limited company, that is the registered office. For a sole trader, it is your principal place of business in the UK. Many home-based coaches give their home address because it is their place of business, so think about whether a business address service makes sense before you register.
• Your staff band: 10 or fewer, 11 to 250, or more than 250.
• Your turnover band: up to £632,000, up to £36 million, or above.
• Whether you are a public authority (you are not).

The online form also asks for a contact person and payment details. The register then shows your business name, a registration number and the date your entry expires. Your registration number is the thing to put on your privacy notice and in corporate supplier forms.

When do you pay, and when does it renew?

Within 21 days of becoming a data controller, then every 12 months. Regulation 2 defines the "charge period" as the 12 months starting on the day you become a data controller, and requires payment "within the first 21 days of each charge period." For a new coach, that day is usually the first time you store a paying client's details: the first booking, the first intake form or the first contract.

So a coach who signs their first paying client on 3 March has until roughly 24 March to pay. A direct debit renews automatically and costs £5 less each year, which makes it the sensible choice. If you pay by card, put the renewal date in your calendar with a reminder two weeks ahead.

How do you register, step by step?

The whole process takes about 15 minutes. Do it in one sitting.

1. Confirm you are the controller. If you trade as a sole trader, register in your own name with your trading name if you have one. If you coach through a limited company, register the company. If you only coach as an employee of someone else's business, your employer is the controller and you do not register separately.
2. Run the regulator's self-assessment. It is on the data protection fee page. Answer honestly about electronic records. For almost every coach the answer is "you need to pay."
3. Work out your tier. Use the table above. A solo coach is tier 1.
4. Fill in the registration form. Give your name, address, staff band and turnover band, plus a contact email you actually check.
5. Pay by direct debit. It saves £5 a year and renews without you remembering.
6. Save your registration number. Keep it next to your insurance policy number in your business records.
7. Add the number to your privacy notice and contract. You can use the wording in the next section.
8. Set a calendar reminder. Make it 11 months from today to check your entry, your tier and your address.

Two of these steps cause most of the confusion. Step 1 is the first. Coaches who also hold a salaried role sometimes assume their employer's registration covers their private clients. It does not. Your side practice is a separate controller. Step 7 is the other. Registration on its own tells clients nothing, so the number has to go where they will see it.

What GDPR basics should a coach set up the same day?

Five things: a privacy notice, a lawful basis for each kind of data, a rule for health information, a retention period and a basic security routine. Paying the fee is the administrative part. UK GDPR is the part that governs how you treat a client's information. Coaches handle more sensitive material than most small businesses, so these matter more than they would for a florist.

1. A plain privacy notice

A privacy notice tells clients what you collect, why, who sees it, how long you keep it and what rights they have. Put it on your website and link it from your booking page and intake form. Here is a starting draft for a solo coach. Edit every bracket, and have an adviser review it if your practice is unusual.

Privacy notice for [Your Name] Coaching

[Your Name], trading as [Trading Name], [address], is the controller of the personal data you share with me. Data protection registration number: [number].

What I collect: your name, email, phone number and time zone; your answers to my intake questions; notes I make during and after our sessions about your goals and progress; messages we exchange; our signed coaching agreement; and payment records.

Why: to deliver the coaching you have contracted for (contract), to keep accounts and meet tax rules (legal obligation), and, only if you opt in, to send you my newsletter (consent). If you choose to tell me about your physical or mental health, I use it only to tailor our sessions, and only with your explicit consent, which you can withdraw at any time.

Who else sees it: the coaching platform, payment processor, calendar and email provider I use to run my practice, each acting on my instructions. I never sell your data or share session content with your employer, even when your employer pays, unless you agree in writing.

How long I keep it: session notes and intake answers for [12] months after our last session, then I delete them. Payment and invoice records for as long as tax law requires.

Your rights: you can ask for a copy of your data, ask me to correct or delete it, object to marketing, or complain to the UK data protection regulator. Contact me at [email].

2. A lawful basis for each kind of data

Most coaching data rests on contract, because you need a client's details and session notes to deliver what they paid for. Accounts rest on legal obligation. Marketing emails to people who are not clients rest on consent. Write these down once in a simple table in your business records. That page is where you will start if anyone ever asks how you handle data.

3. A rule for health and other sensitive information

Under UK GDPR, health information is "special category" data with stricter rules. That includes stress, anxiety, sleep, menopause symptoms, eating patterns, diagnoses and medication. Health, wellness, ADHD, menopause and many life coaches collect it as a matter of routine. The usual approach for a coach is explicit consent: a separate tick box on the intake form that says exactly what you will collect and why, not buried inside the general terms.

"I agree that [Your Name] may record health information I choose to share (for example sleep, stress, energy, symptoms or medication) and use it only to tailor my coaching. I understand coaching is not medical or psychological treatment, and I can withdraw this consent at any time by emailing [email]."

Keep the scope line in that wording. Coaching is not treatment. If a client describes symptoms of a medical or mental health condition that is not being managed, refer them to their GP or a licensed professional. Do not record those details as a clinician would.

4. A retention period

Pick a number and stick to it. Twelve months after the last session works for many coaches: long enough for a returning client to pick up where they left off, short enough that you are not holding years of personal stories you no longer need. Financial records follow tax rules, so keep invoices and payment records separately for as long as HMRC requires. Your accountant can confirm the period.

5. A basic security routine

• Use a password manager and two-factor sign-in on email, calendar, cloud storage and your coaching platform.
• Do not keep session notes in personal notes apps or chat apps that sync to a shared family account.
• Do not record sessions unless the client agrees. Store recordings in one place and delete them on the same schedule as notes.
• Lock your phone and laptop. Coaches type notes in cafés and on trains more than they admit.
• Know what to do if something goes wrong. Under UK GDPR, a personal data breach that risks people's rights generally has to be reported to the regulator within 72 hours of you becoming aware of it. That covers a lost laptop with unencrypted notes or an intake form emailed to the wrong client. Write the regulator's breach reporting page into your records now, while you are calm.

This is general information, not legal advice. If you work with children, run group programmes inside organisations, or coach people about debt, addiction or trauma, take specific advice from a solicitor or data protection practitioner.

Which situations change the answer?

Most edge cases come down to who the controller is and where you are based. Here are the ones coaches ask about most.

The associate coach row causes the most argument, and there is no single answer. A firm might issue you its laptop, its note templates and its client portal, and forbid you from keeping your own copies. In that case you are processing on its behalf. If you keep your own notebook and your own spreadsheet of clients, you are making controller decisions. Many associates simply pay the tier 1 fee to be safe, which costs less than an hour of argument.

What does this look like for a real-world practice? A fictional example

This example is fictional. The figures are illustrative, not data about any real coach.

Ama is a career coach in Leeds in her second year of practice. She works as a sole trader with a turnover of around £41,000, all from one-to-one coaching packages and two corporate outplacement contracts. Her client details live in five places: a Google Calendar, a Gmail inbox, a notes app on her phone, a spreadsheet of who has paid, and a folder of PDF intake forms on her laptop.

A corporate client's procurement team sends a supplier form asking for her data protection registration number. She does not have one. She spends a Sunday morning on the steps above.

1. The self-assessment tells her she needs to pay. Her notes app alone counts as automated processing.
2. She is in tier 1 on both turnover and staff. She pays £47 by direct debit and gets her registration number the same day.
3. She adapts the privacy notice above. She sets a 12-month retention period for session notes and adds an explicit consent box. Clients in career transitions often mention burnout or health issues, so she needs it.
4. She looks at the five places her data lives and decides to cut them down. Every new client from now on will go into one client record, with notes, intake answers, the signed agreement and payments together. The old PDFs older than 12 months get deleted that afternoon.
5. She replies to procurement with the registration number and a link to her privacy notice. The contract goes ahead.

The part that took longest was not the fee. It was working out where her clients' information actually was. That is normal, and it is why the next section exists.

How do you set up client data in Coachful when you are starting out?

If you are building your practice now, set up your tools so one client equals one record you can secure, export and clear out. Coachful is a coaching platform built for that. Booking, payments, coaching agreements, programmes, messaging and client notes sit behind one login for you and one branded app for your client. We make it, so weigh this section accordingly. Your fee and your privacy notice work the same whatever tools you choose.

Here is how the GDPR basics above map onto it, using only features Coachful documents:

• Intake with a purpose. Booking pages can ask intake questions when someone books, and the answers land on that person's record. Ask only what you need for the first session. Put the explicit-consent wording above on the form if you collect health information. See booking software for coaches.
• Agreements before the first call. Coaching agreements with e-signature go out before the first session and are stored on the client record. That is the natural place to include your privacy notice link and registration number.
• One client record. Goals, check-ins, habits, notes, intake answers, tags, payments and sessions sit together on the profile. You stop scattering session notes across a phone app and a spreadsheet. More on that on the coaching CRM page.
• Payments through your own processor. Payments run through your own Stripe Connect or Razorpay account, with an invoice for each transaction. Your accounts records stay separate from coaching notes, which helps when financial records and notes have different retention periods.
• A full export. You can export all client data as a ZIP: roster, notes, check-ins, goals, habits, sessions and form responses. That helps when a client asks for a copy of their data, and when you check what you hold at renewal time. Coachful describes itself as GDPR-ready.

The intake calls view keeps every booked discovery call in one list with contact details and status. A no-show who never became a client is someone whose details you can delete on your retention schedule.

This walkthrough shows where your data lives in Coachful and how the export works:

Coachful has limits that matter here. It is not HIPAA-certified, does not offer a BAA, and is not built for clinical record-keeping or insurance billing. If you are also a therapist, dietitian or other regulated clinician, clinical records belong in a clinical system (our SimplePractice alternatives for coaches guide covers that line). Coachful is based in Tallinn, Estonia. Ask any vendor, us included, for its data processing terms before you list it in your privacy notice.

Why Coachful stands out: a free white-glove service. From Create, the "We'll build it for you" option lets you describe what you need: an intake form, a booking funnel, a website, or a welcome email sequence that links your privacy notice. The Coachful team builds it inside your own account, usually within about 24 hours. Nothing gets invented. Gaps such as your registration number or retention period are left for you to fill in. Read more about the free white-glove service. There is a free trial (current plans: Lite: $29/month for up to 5 clients; Solo: $49/month for up to 20 clients; Pro: $99/month with unlimited clients; Studio: $199/month with unlimited clients).

Where does the fee fit with your money records?

Treat it as a normal business expense alongside insurance and software. The fee itself is small. What matters is putting it on the same yearly cycle as your other admin, so you do not forget it. Many coaches keep a one-page "annual compliance" list:

• Data protection fee renewal (direct debit, check your tier and address).
• Professional indemnity insurance renewal.
• Privacy notice review: still accurate about the tools you use?
• Retention clear-out: delete notes and intake forms past your retention period.
• Credential hours logged, if you are working toward an ICF credential (see ICF hour tracking).

Invoices and payment records fall under the accounts exemption on their own. That is why bookkeepers sometimes do not pay. Your coaching notes are what bring you into the fee. Keeping the two clearly separate also makes your retention rules simpler to follow.

What mistakes do new coaches make with ICO registration?

• Assuming "too small to matter." The law has no minimum size. Tier 1 exists for exactly this reason, and £52 a year is the price of not worrying about it.
• Claiming the marketing or accounts exemption. Those exemptions only work if all of your processing fits them. Client notes do not.
• Registering the wrong legal person. If you set up a limited company, the company should be registered. A personal registration from your sole-trader days does not carry over.
• Letting a card payment lapse. The register shows an expiry date. Corporate buyers notice, and the penalty regime does not care that you forgot.
• Paying, then doing nothing else. A registration number with no privacy notice, no retention rule and health notes in a family-shared notes app is not compliance.
• Collecting health details "just in case." An intake form asking for medications and diagnoses you never use creates risk without benefit. Ask only for what shapes the coaching.
• Sharing session content with the paying employer. In executive and leadership coaching the sponsor often wants updates. Agree in writing at the start what gets reported (attendance, themes the client agrees to) and what stays confidential.
• Keeping a lead magnet list mixed in with client notes. Marketing consent and client contracts are different lawful bases. Keep them as separate lists. Our guide to lead magnets for coaches covers building the list itself, and email marketing for coaches covers sending to it properly.

Frequently asked questions

Do life coaches need to register with the ICO?

Yes, if they are based in the UK and keep any client information electronically. Life coaching involves recording clients' goals and personal circumstances, which is not covered by any exemption. Most life coaches are tier 1 and pay £52 a year, or £47 by direct debit, as listed in November 2026.

How much is the data protection fee for a sole trader coach?

A sole trader coach with a turnover of £632,000 or less, or 10 or fewer staff, is in tier 1. The charge is £52 a year, reduced by £5 to £47 if you pay by direct debit. Those amounts have applied since 17 February 2025 under regulation 3 of the 2018 Regulations.

Is ICO registration the same as being GDPR compliant?

No. The fee is a separate legal duty that funds the regulator and puts you on the public register. GDPR compliance covers how you collect, use, protect and delete personal data. That means having a privacy notice, a lawful basis, a retention period and decent security. You need both.

Can I be exempt if I only use paper notes?

Possibly. Paper records not meant to be processed electronically are exempt. But all your processing has to be exempt for you to skip the fee. A client's email address in your inbox, a calendar booking or a typed invoice usually ends the exemption. Run the regulator's self-assessment if you are not sure.

When do I have to pay as a new coach?

Within the first 21 days of your first charge period. The period starts the day you become a data controller, typically the first time you store a client's details for your business. After that, you pay within 21 days of the start of each 12-month period.

What happens if I do not pay?

The regulator can issue a fixed penalty. The law caps it at 150% of the highest charge payable, ignoring discounts. At current rates that works out at a ceiling of £5,644.50. The actual amount follows the regulator's published penalty scale, so check that for the current figure.

Is it called the ICO or the Information Commission now?

The legislation was amended from 30 September 2026 to refer to the Information Commission, following the Data (Use and Access) Act 2025. Most coaches, clients and procurement forms still say ICO, and the fee duty is the same.

Do I need consent to keep session notes?

Usually not for ordinary session notes, which you can keep because you need them to deliver the coaching your client contracted for. Health and other special category information is different. Most coaches rely on explicit consent for it, collected with a separate, specific tick box. This is general information, not legal advice.

What is Coachful's free white-glove service?

It is a build service included on every Coachful plan. You describe what you want, such as an intake form, booking funnel, website or email sequence. You can attach references and files, and the Coachful team builds it inside your account, usually within about 24 hours. It leaves gaps like your registration number for you to fill in rather than inventing details.

Can Coachful store health information from my clients?

Coachful stores intake answers, notes and check-ins on the client record and describes itself as GDPR-ready. It is not HIPAA-certified and is not a clinical records system. Use explicit consent for any health details, keep coaching notes within coaching scope, and use a clinical system if you also practise as a regulated clinician.