Who was sanctioned, and for what?

The UK Information Commissioner's Office (ICO) issued a reprimand to ACRO Criminal Records Office. According to the ICO, it followed a cyber incident that may have affected the personal data of around 10,000 people in the UK. The ICO found infringements of the duty to implement appropriate technical and organisational security measures under Article 32 UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Elderly Aids Limited, a seller of call-blocking devices, £190,000 and also issued an enforcement notice. The ICO found that the company had made 758,053 unsolicited direct marketing calls to numbers registered with the TPS/CTPS whose subscribers had not agreed to such calls, leading to 20 complaints. The legal basis is regulations 21 and 24 of PECR. Under the notice, payment by 7 September 2026 reduces the amount by 20% to £152,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998 (Geldbuße), section 40 DPA 1998 (Anordnung)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Original amount 190,000 GBP, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Data Protection Act 2018, Section 40

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Culpability

negligent

Published

5 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and issued an enforcement notice. After executing a search warrant in April 2025, the regulator found that between October 2024 and March 2025 the company had instigated 575,062 unsolicited marketing calls to numbers that had been on the TPS register for more than 28 days. There were 132 complaints. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 240,000 GBP, converted at the ECB reference rate of 28 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined a UK marketing company £300,000 and issued an enforcement notice. The ICO found that the company had sent more than 5.5 million unsolicited marketing text messages, including messages styled as if they came from bailiffs. The 7726 spam reporting service received over 60,000 complaints. The ICO relied on regulations 22 and 23 of PECR (electronic marketing without consent and concealed sender identity).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 22 und 23 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 300,000 GBP, converted at the ECB reference rate of 20 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2020, malware entered the water supplier's network via a phishing e-mail and remained undetected for around 20 months; in 2022, attackers obtained administrator rights and stole data on 633,887 people, which ended up on the dark web. The UK Information Commissioner's Office (ICO) criticised, among other things, monitoring of only 5% of the IT environment, outdated software such as Windows Server 2003 and a lack of vulnerability and patch management.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

40% reduction for early admission of liability; payment agreed without appeal.

Published

11 May 2026

Original amount 963,900 GBP, converted at the ECB reference rate of 7 May 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued an enforcement notice to a UK company. The ICO found that the company had instigated calls about claims management services without the consent of the people called. Under regulation 21A of PECR such calls are only permitted with prior consent; the ICO also found a breach of regulation 24. The notice is an enforcement notice and does not impose a fine.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21A und 24 PECR; section 40 DPA 1998

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Energy Prices Direct Limited, an energy switching broker, £160,000. The ICO found that the company had obtained contact details from public sources and list providers and did not screen them against the TPS/CTPS registers before making marketing calls. The legal basis is regulations 21 and 24 of PECR. Under the notice, timely payment reduces the amount by 20% to £128,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Original amount 160,000 GBP, converted at the ECB reference rate of 30 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In March 2026 the ICO fined a small UK direct marketing company £130,000 and also served an enforcement notice. According to the ICO, over almost eleven months in 2024 the company had staff make more than 230,000 marketing calls to lines that had been on the UK's opt-out register for sales calls (Telephone Preference Service, TPS) for over 28 days, prompting 12 complaints. The ICO treated this as a breach of regulation 21 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 130,000 GBP, converted at the ECB reference rate of 12 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Reddit, Inc. £14,472,500. The regulator found that the platform did not use any robust age assurance and therefore had no lawful basis for processing the personal data of children under 13. The ICO also found that Reddit had not carried out a data protection impact assessment on the risks to children before January 2025. The ICO found infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155 DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 14,472,500 GBP, converted at the ECB reference rate of 23 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined MediaLab.AI, Inc., which operated the Imgur platform in the UK until 30 September 2025, £247,590. The ICO found that Imgur admitted children under 13, stated to be under parental supervision, and relied on consent as its lawful basis, but it had no way of establishing users' ages and therefore of obtaining the required parental consent. The ICO therefore found there was no valid lawful basis and also found that no data protection impact assessment had been carried out (Articles 5(1)(a), 6, 8 and 35 UK GDPR).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155(1)(a) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 247,590 GBP, converted at the ECB reference rate of 4 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined TMAC Ltd £100,000 and issued an enforcement notice. The ICO found that between 8 February and 24 September 2024 the company made 260,332 unsolicited marketing calls to numbers registered with the Telephone Preference Service (TPS). Recipients were also not given the caller details required by regulation 24 of PECR. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21(1)(b) und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 100,000 GBP, converted at the ECB reference rate of 3 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Allay Claims Ltd £120,000 and issued an enforcement notice. The ICO found that the company had sent a large volume of unsolicited text messages promoting services to reclaim tax on PPI refunds; the enforcement notice gives the period as 1 February 2023 to 13 February 2024. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 120,000 GBP, converted at the ECB reference rate of 15 Jan 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined ZMLUK Limited £105,000. The ICO found that the company had sent unsolicited marketing emails for energy-saving products; the notice gives the period as 1 January to 21 July 2023. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent). Under the notice, timely payment reduces the amount by 20% to £84,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 105,000 GBP, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

On 2 December 2025 the ICO issued a reprimand to Post Office Limited. The ICO found that on 25 April 2024 the company put the unredacted version of a settlement deed on its corporate website instead of the intended redacted one, exposing personal data of 502 postmasters who had taken part in the 2017 group litigation linked to the Horizon IT scandal. The ICO concluded that appropriate technical and organisational measures were lacking, in breach of Articles 5(1)(f), 32(1) and 32(2) UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1) und 32(2) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2022, an attacker first compromised an employee's company laptop and then the personal laptop of a senior employee, whose master password he captured using a keylogger. Because the personal and business password vaults were linked via the same master password, he obtained the access and decryption keys stored there and stole data on up to 1.6 million UK users from the backup database. According to the annual accounts filed with the UK companies register for financial year 2025, the company had around 35 employees.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 lit. f

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

Under 50

Culpability

negligent

Published

11 Dec 2025

Original amount 1,228,283 GBP, converted at the ECB reference rate of 20 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

The ICO fined Lead Pronto Ltd £30,000 and issued an enforcement notice. The ICO found that the company had sent unsolicited text messages promoting government-funded boiler grants. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 30,000 GBP, converted at the ECB reference rate of 6 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In March 2023, an employee unintentionally downloaded malicious files; although an alert was triggered after ten minutes, the device was only isolated after 58 hours. Attackers stole around one terabyte of data on 6.6 million people (including pension data and criminal record information). Fines imposed by the UK Information Commissioner's Office (ICO): £8 million against Capita plc and £6 million against Capita Pension Solutions.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32

Action

Fine

Status of proceedings

final

Sector

Other

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

£45 million had provisionally been proposed; reduced, among other things, for security improvements, credit monitoring for those affected and cooperation with authorities and the NCSC.

Published

15 Oct 2025

Original amount 14,000,000 GBP, converted at the ECB reference rate of 15 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link