Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific and Middle East: 1,918 cases from 40 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

1case from 1 jurisdiction
€75,282Total of monetary amounts
€75,282Largest single case: Police Service of Scotland
€75,282Median per case with an amount

Click a bar to drill down one level.

When?

per quarter, by date of decision
Trend
PeriodCasesTotal
Q4 20230–
Q1 20240–
Q2 20240–
Q3 20240–
Q4 20240–
Q1 20250–
Q2 20250–
Q3 20250–
Q4 20251€75,282
Q1 20260–
Q2 20260–
Q3 20260–
Q4 20260–

1 case

12 Dec 2025 Police Service of ScotlandICO: £66,000 fine and reprimand for Police Scotland over handling of sensitive data United KingdomData breaches and data security €75,282

The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).

Authority / court
Information Commissioner's Office (ICO)
Area of law
Data protection · Data breaches and data security
Legal basis
Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018
Action
Fine
Status of proceedings
unknown
Sector
Public sector

Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

Ready for training that actually lands?

Try the combination for free: automated administration for you, learning formats that fit your team, with no minimum or credit card.

Start 14-day free trial