UK enforcement
Regulatory and criminal outcomes are different tracks, so every record here is typed by action and never merged into a single fines column. A penalty notice and an enforcement notice issued together are two records. 18 records, newest first.
-
£1,500
2026-08-26
Former chief executive, Mid and East Antrim Borough Council
Deleting, and procuring the deletion of, an email to prevent its disclosure in response to a freedom of information request (FOIA 2000 s.77); The request reached the council on 2021-04-26; the email, to the then First Minister, was deleted days later.
Convicted at Ballymena Magistrates' Court on two counts and fined £750 on each; acquitted of a third count of attempting to delete a second email, and a co-defendant director was acquitted. The defendant said she would challenge the convictions. It follows a town clerk's guilty plea under s.77 in 2020, and shows the offence reaches senior officers personally.
Source: Former council chief convicted of deleting email subject to FOI Act, ITV News
-
£8m
2025-10-15
Capita plc
March 2023 cyber attack affecting about 6.6 million people across both Capita entities; Failure to ensure the security of processing (Art 5(1)(f) and Art 32).
One of two penalty notices issued together; Capita Pension Solutions Limited is recorded separately. The regulator first proposed £45m across both entities. The final figure followed a voluntary settlement in which Capita admitted liability and agreed not to appeal.
Source: Capita fined £14m for data breach affecting over 6m people, Information Commissioner's Office
-
£6m
2025-10-15
Capita Pension Solutions Limited
The same March 2023 attack, affecting data held for pension schemes it administered; Failure to ensure the security of processing (Art 5(1)(f) and Art 32).
Issued with the Capita plc notice under the same voluntary settlement. The penalty is on the processor entity that administered the pension schemes, which shows that a processor is directly liable for its own security failures.
Source: Capita fined £14m for data breach affecting over 6m people, Information Commissioner's Office
-
£1,500
2025-10-08
Former insurance claims adviser, BISL Limited
Unlawfully obtaining personal data (DPA 2018 s.170(1)); Accessed 1,550 customer records, many outside working hours or on leave.
Guilty plea at Leeds Crown Court on 2025-07-30; fined £1,500 at sentencing. A typical insider case: an employee with legitimate system access using it for no business reason.
Source: Qonain Hussain (enforcement action), Information Commissioner's Office
-
£300,000
2025-09-25
Home Improvement Marketing Ltd
2,449,380 automated marketing calls between May and August 2023 without consent (PECR reg 19); The automated system gave recipients no way to stop further calls.
One of two energy marketing firms fined together for unlawful automated calls, £550,000 between them. Automated calls need prior consent under reg 19, which is a stricter rule than the screening that applies to live calls.
Source: Warning over robo calls as energy firms fined half a million pounds for unlawful marketing calls, Information Commissioner's Office
-
£250,000
2025-09-25
Green Spark Energy Ltd
Unlawful automated marketing calls made without consent.
Fined alongside Home Improvement Marketing Ltd in the same announcement on unlawful automated energy marketing calls.
Source: Warning over robo calls as energy firms fined half a million pounds for unlawful marketing calls, Information Commissioner's Office
-
£1,100
2025-09-03
Director of a care home company (Bridlington Lodge)
Blocking, erasing or concealing records to prevent disclosure in response to a subject access request (DPA 2018 s.173); The request, made in April 2023 under a lasting power of attorney, sought incident reports, CCTV footage and care notes.
Convicted at Beverley Magistrates' Court and fined £1,100 with £5,440 costs. The court rejected defences that staff had already supplied the records, that the home's manager was responsible, and that the company was no longer registered with the regulator. The director was prosecuted personally, which is the point: s.173 reaches individuals.
Source: Care home director found guilty of ignoring request for personal information, Information Commissioner's Office
-
£2.31m
2025-06-17
23andMe
2023 credential stuffing attack exposing the data of 155,592 UK residents, including genetic data; No adequate authentication and verification, no control over access to raw genetic data, and no effective monitoring for threats (Art 5(1)(f) and Art 32).
Penalty for security failures over highly sensitive genetic data, announced while the company was in US bankruptcy proceedings.
Source: 23andMe fined for failing to protect UK users' genetic data, Information Commissioner's Office
-
£3.07m
2025-03-27
Advanced Computer Software Group Ltd
2022 ransomware attack on a processor serving NHS and care providers; personal data of about 80,000 people taken, over 40,000 of them special category; Processor security failures, including incomplete multi-factor authentication (Art 32).
The first UK GDPR penalty on a processor rather than a controller. The regulator's provisional figure was just over £6m; the final £3.07m followed representations and a voluntary settlement in which the company agreed not to appeal.
Source: Advanced Computer Software Group Limited (enforcement action), Information Commissioner's Office
-
Six months, suspended
2024-10-08
Two former RAC call centre customer service specialists
Copying and sharing about 29,500 records of road traffic accident victims, reportedly sold to a third party; Charged under the Computer Misuse Act 1990 and the DPA 2018.
Sentenced at Minshull Street Crown Court to six months' imprisonment each, suspended for 18 months, and 150 hours' unpaid work. Custody was available only because of the Computer Misuse Act count: the DPA 2018 offences are fine-only.
Source: Criminal record and suspended prison sentence handed to former RAC employees, Information Commissioner's Office
-
£750,000
2024-10-03
Police Service of Northern Ireland
Spreadsheet released in response to an FOI request with a hidden tab naming all officers and staff; Failure to have appropriate measures for disclosures (Art 5(1)(f) and Art 32).
The regulator said the penalty would have been £5.6m without its public sector approach. The breach began as an FOI response, which is why FOI disclosure checks and data protection security belong in the same procedure.
Source: What price privacy? Poor PSNI procedures culminate in £750k fine, Information Commissioner's Office
-
Reprimand
2024-09-17
Bonne Terre Limited (Sky Betting and Gaming)
Personal data shared with advertising technology companies before users could accept or reject advertising cookies, 2023-01-10 to 2023-03-03; Processing found not lawful, transparent or fair.
A reprimand, so no fine. It is the clearest UK example of cookie consent failing because of timing: the banner existed, but data had already gone before the user chose. Read with PECR reg 6 and the cookie exemption audit.
Source: Action taken against Sky Betting and Gaming for using cookies without consent, Information Commissioner's Office
-
£1,200
2024-09-17
Former sales consultant, Leaseline Vehicle Management Ltd
Unlawfully obtaining and selling personal data (DPA 2018 s.170); More than 3,600 customer records taken and sold to competitors.
Guilty plea; fined £1,200 with £300 costs at St Albans Crown Court. The employer found the breach and reported it, which is the route most s.170 cases start from.
Source: Guilty car salesman fined for retaining and selling data to competitors, Information Commissioner's Office
-
£12.7m
2023-04-04
TikTok Information Technologies UK Limited and TikTok Inc
Processing data of children under 13 without parental consent; Lawfulness, fairness and transparency failures.
Appeal history: the First-tier Tribunal decided a preliminary issue for the regulator on 2025-07-04; the Upper Tribunal dismissed TikTok's appeal on that issue on 2026-07-28 and sent the case back; TikTok then withdrew its appeal on 2026-09-24, so the penalty is final at the original figure.
Source: ICO welcomes tribunal ruling on preliminary issue raised by TikTok in its appeal of 2023 penalty, Information Commissioner's Office
-
£7.5m
2022-05-18
Clearview AI
Scraping images of people in the UK from the web without a lawful basis; Biometric data processed without meeting a special category condition.
Penalty notice issued alongside an enforcement notice (recorded separately). The First-tier Tribunal held on 2023-10-17 that the regulator lacked jurisdiction; the Upper Tribunal ([2025] UKUT 319 (AAC), 2025-10-07) allowed the regulator's appeal on three of four grounds and remitted the substantive appeal to the First-tier Tribunal. Clearview indicated it intended to appeal the Upper Tribunal ruling.
Source: The Information Commissioner's Office v Clearview AI Inc [2025] UKUT 319 (AAC), GOV.UK / Upper Tribunal (AAC)
-
Stop and delete order
2022-05-18
Clearview AI
Ordered to stop obtaining and using UK residents' publicly available data; Ordered to delete UK residents' data from its systems.
Enforcement notice issued with the penalty notice and subject to the same appeal history: jurisdiction refused by the First-tier Tribunal, restored by the Upper Tribunal in 2025 and remitted.
Source: The Information Commissioner's Office v Clearview AI Inc [2025] UKUT 319 (AAC), GOV.UK / Upper Tribunal (AAC)
-
£18.4m
2020-10-30
Marriott International
Starwood guest reservation database breach; Security and due diligence failures (Art 5(1)(f) and Art 32 GDPR as it then applied).
Penalty notice under DPA 2018 s.155, reduced from a notice of intent of £99.2m to £18.4m. Recorded as not appealed. Penalty covered the period from 2018-05-25, when the GDPR took effect.
Source: ICO GDPR fines reduced to £20m and £18.4m to reflect British Airways and Marriott mitigating factors, Morgan Lewis
-
£20m
2020-10-16
British Airways
2018 breach affecting customer payment and personal data; Security failures (Art 5(1)(f) and Art 32 GDPR as it then applied).
Penalty notice under DPA 2018 s.155, reduced from a notice of intent of £183.39m to £20m after representations and mitigation. Recorded as not appealed. Conduct pre-dated the end of the transition period, so the infringement is under the GDPR as it applied in the UK, enforced through the DPA 2018.
Source: ICO GDPR fines reduced to £20m and £18.4m to reflect British Airways and Marriott mitigating factors, Morgan Lewis