The notification fee is not onerous - just £35 a year for most companies. But failing to notify the Information Commissioner that you are trading personal data is a criminal offence. In this case, the director was also liable for being negligent in ensuring the company complied with its statutory duties. The ICO website has a helpful checklist to figure out if you need to notify and it's worth making use of it or checking with your lawyer if you're unsure.