Who was sanctioned, and for what?

The UK Information Commissioner's Office (ICO) issued a reprimand to ACRO Criminal Records Office. According to the ICO, it followed a cyber incident that may have affected the personal data of around 10,000 people in the UK. The ICO found infringements of the duty to implement appropriate technical and organisational security measures under Article 32 UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Data Protection Act 2018, Section 40

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Culpability

negligent

Published

5 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Cardiff University was fined £280,000 and ordered to pay £11,745 in costs after two employees developed occupational asthma from exposure to animal allergens. According to the Health and Safety Executive, the university failed from 2008 to 2025 to identify and implement suitable controls against allergen exposure, although the COSHH regulations and relevant guidance had long been in place.

Authority / court

Cardiff Magistrates' Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 2(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

Guilty plea.

Published

1 May 2026

Original amount 280,000 GBP, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

During a public order training exercise in February 2021, police officers wearing flame-retardant protective clothing had petrol bombs thrown at them; four officers suffered burns with permanent scarring. There was no information on the service life and testing of the PPE, no risk assessment for the manufacture and use of the petrol bombs, and no safe systems of work. The Health and Safety Executive (HSE) prosecution resulted in a fine of 60,000 GBP plus 9,470 GBP in costs.

Authority / court

Health and Safety Executive (Sheffield Magistrates' Court)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Health and Safety at Work etc. Act 1974, s. 2(1)

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

20 Jan 2026

Original amount 60,000 GBP, converted at the ECB reference rate of 19 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In June 2023, a lamp post dating from the 1950s/60s, whose steel at the base was at least 60 % rusted through, fell over and seriously injured a pedestrian. The post had been rated as poor in 2022 but was not scheduled for replacement until 2024; the council's visual inspections did not identify the acute risk of collapse. The Health and Safety Executive (HSE) prosecution resulted in a fine of 80,000 GBP.

Authority / court

Health and Safety Executive (Glasgow Sheriff Court)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Health and Safety at Work etc. Act 1974, s. 3(1)

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

12 Jan 2026

Original amount 80,000 GBP, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued an enforcement notice to South Wales Police over serious delays in handling subject access requests. The ICO found that from April 2023 to March 2024 the force answered only 29% of requests on time; in August 2025, 352 requests were overdue, one of them by almost two years. The ICO ordered the force to clear the backlog by June 2026. The legal basis is Articles 12(3), 15(1) and 15(3) UK GDPR and section 45 of the Data Protection Act 2018. According to the notice, the force employs almost 3,000 police officers and over 2,200 other staff.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 45 DPA 2018; section 149 DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued an enforcement notice to Bristol City Council because it found that the council had not responded to subject access requests as required by law. The notice relies on Articles 12(3), 15(1) and 15(3) UK GDPR and examines, among other things, the period from 1 April 2023 to 31 March 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 149 DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to South Yorkshire Police. The ICO found that during a data transfer in July 2023, carried out by a third-party supplier within the digital evidence management system, 96,174 original body-worn video recordings were accidentally deleted. The ICO found that the force lacked appropriate technical and organisational security measures and could not demonstrate compliance. The action was based on the law-enforcement processing rules in Part 3 of the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

section 34(3) und section 40 DPA 2018 (Part 3)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the London Borough of Hammersmith and Fulham. The ICO found that, in answering a Freedom of Information request, the council released a spreadsheet that contained hidden data. This exposed personal data of 6,528 people, 2,342 of them children. The ICO criticised inadequate security measures and a failure to demonstrate compliance.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 5(2), 24(1), 32(1)(b) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the Chief Constable of Greater Manchester Police. The ICO found that, because of a persistent backlog of historic requests, the force repeatedly failed to answer subject access requests on time. The ICO found infringements of both the UK GDPR and the law-enforcement provisions of the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) und Art. 15 UK GDPR; section 45 und section 54 DPA 2018 (Part 3); Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the Chief Constable of Greater Manchester Police. The ICO found that CCTV footage from a police station custody suite in 2021, which was to be retained because of serious allegations against officers, was not checked for completeness when it was preserved and was partly lost. In addition, the individual concerned did not receive their data on time after a subject access request. The action was based on the law-enforcement processing rules in the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

section 45(3)(a) und (b) DPA 2018; sechster Datenschutzgrundsatz (section 40 DPA 2018, Part 3)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to Glasgow City Council. The ICO found that between April 2023 and March 2024 the council answered only 45% of subject access requests within the statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the City of Edinburgh Council. The ICO found that in 2023 the council failed to answer 40% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to Southend-on-Sea City Council. The ICO found that in a Freedom of Information response published on a public platform in May 2023, a spreadsheet contained hidden personal data of current and former staff, including contact, pay and health details. The error was only noticed months later. The ICO found a breach of the requirement for appropriate data security.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In its response to a freedom of information request, a UK police service published an Excel file whose hidden worksheet contained the surnames, initials, rank and role of all its employees. The file was visible for just over two hours and was deleted after almost three hours; the police service assumed that it had fallen into the hands of militant groups.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

1,000 to 9,999

Culpability

negligent

Mitigating circumstances

Application of the public sector approach; without it, the fine would have been £5.6 million.

Published

3 Oct 2024

Original amount 750,000 GBP, converted at the ECB reference rate of 26 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Sep 2026 · Direct link

The ICO issued a reprimand to an academy in Essex with around 1,200 pupils aged 11 to 18. According to the ICO's findings, the school introduced facial recognition for cashless catering in March 2023 without first carrying out the required data protection impact assessment, which was only completed in November 2023. Until then it assumed consent unless parents had opted their children out, which in the ICO's view is not valid consent, and it did not seek advice from its data protection officer. The reprimand is based on an infringement of Article 35(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 35(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 Jul 2026 · Direct link

On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link

The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link