As a small business owner, the ICO sent me multiple threatening letters soliciting an annual fee, which I at first suspected to be a scam. After wasting 30 minutes reading their small print, I realised this is genuine, but my organisation is exempt, and I'm now registered as such. Data protection (and GDPR) is important, but the ICO approach to companies is wrong, un-necessarily threatening and builds hostility not education and understanding.
