United Kingdom
UK data protection fines and ICO enforcement
The Information Commissioner (now the Information Commission) fines under UK GDPR, the Data Protection Act 2018 and PECR. Many penalties end lower than the figure first announced in a notice of intent, so each record shows the final amount and, where it differs, the proposed one.
Since 5 February 2026 PECR breaches, which include cookies and marketing messages, can be fined at UK GDPR levels: up to £17.5 million or 4% of worldwide turnover.
Last checked . Amounts are in the original currency; conversions are approximate.
Fines, largest first
-
£14.5m about €16.6m
Reddit, Inc.
The ICO found Reddit had no robust age assurance, so it lacked a lawful basis to process data of UK children under 13, and had not completed a DPIA on risks to children before January 2025. The July 2025 notice of intent proposed £17,573,750; the final penalty was lower.
Proposed at £17.6m before the final decision.
UK GDPR, Art. 5(1)(a), Art. 6, Art. 8, Art. 35
Read the ICO decision on Reddit, Inc. -
£14m about €16.1m
Capita plc and Capita Pension Solutions Ltd
A 2023 ransomware attack exposed data on 6.6 million people; the ICO found Capita lacked admin account tiering, took 58 hours to contain an alerted device and under-tested its systems. Capita plc was fined £8m and Capita Pension Solutions £6m.
Proposed at £45m before the final decision.
UK GDPR
Read the ICO decision on Capita plc and Capita Pension Solutions Ltd -
£3.08m about €3.68m
Advanced Computer Software Group Ltd
An NHS IT supplier acting as data processor suffered a 2022 ransomware attack after hackers entered through a customer account without multi-factor authentication, putting data of 79,404 people at risk and disrupting services such as NHS 111.
Proposed at £6.09m before the final decision.
UK GDPR
Read the ICO decision on Advanced Computer Software Group Ltd -
£2.31m about €2.74m
23andMe, Inc.
A 2023 credential stuffing attack reached data of 155,592 UK users, including ancestry and health reports; the ICO found no mandatory MFA, weak controls on raw genetic data downloads and a slow response. It was a joint investigation with the Privacy Commissioner of Canada.
Proposed at £4.59m before the final decision.
UK GDPR, Art. 5(1)(f), Art. 32(1)
Read the ICO decision on 23andMe, Inc. -
£1.23m about €1.39m
LastPass UK Ltd
The ICO found weak security let an attacker take personal data on about 1.6 million UK customers from a LastPass backup database, although encrypted vault contents stayed protected by its zero knowledge design.
Proposed at £2.7m before the final decision.
UK GDPR, Art. 5(1)(f), Art. 32(1)(f)
Read the ICO decision on LastPass UK Ltd -
£964k about €1.12m
South Staffordshire Plc and South Staffordshire Water Plc
After a cyber incident in which data on about 633,887 people was exfiltrated, the ICO found the water company had not kept personal data adequately secure.
UK GDPR, Art. 5(1)(f), Art. 32(1)
Read the ICO decision on South Staffordshire Plc and South Staffordshire Water Plc -
£750k about €890k
Police Service of Northern Ireland
A spreadsheet released in answer to a freedom of information request disclosed personal data of 9,483 police officers and staff. The ICO took account of its revised public sector enforcement approach.
UK GDPR, Art. 5(1)(f), Art. 32(1), Art. 32(2)
Read the ICO decision on Police Service of Northern Ireland -
£350k about €408k
Ministry of Defence
The MOD team handling Afghan relocations emailed people using the To field instead of BCC, exposing 265 email addresses.
UK GDPR, Art. 5(1)(f)
Read the ICO decision on Ministry of Defence -
£300k about €347k
KRA Consultancy Ltd
KRA sent more than 5.5 million unsolicited marketing texts, including fake bailiff messages, generating over 60,000 complaints to the 7726 spam service. An enforcement notice was also issued.
PECR, Reg. 22, Reg. 23
Read the ICO decision on KRA Consultancy Ltd -
£248k about €287k
MediaLab.AI, Inc. (Imgur)
Imgur let UK children under 13 use the platform while relying on consent, but had no way to check ages or obtain parental consent, and did no DPIA for processing children's data. MediaLab geo-blocked the UK on 30 September 2025.
Proposed at £393k before the final decision.
UK GDPR, Art. 5(1)(a), Art. 6, Art. 8, Art. 35
Read the ICO decision on MediaLab.AI, Inc. (Imgur) -
£140k about €163k
Grocery Delivery E-Services UK Ltd t/a HelloFresh
HelloFresh sent about 79 million marketing emails and 1 million texts relying on an opt-in that did not mention texts and was bundled with an age confirmation, and kept marketing to people for up to 24 months after they cancelled.
PECR, Reg. 22
Read the ICO decision on Grocery Delivery E-Services UK Ltd t/a HelloFresh -
£120k about €144k
Quick Tax Claims Limited
The company sent about 7.86 million marketing texts in a month using contact data bought from suppliers that had not obtained valid consent, drawing 66,793 complaints, most citing no opt out.
PECR
Read the ICO decision on Quick Tax Claims Limited -
£105k about €126k
Bluon Energy Ltd
The solar firm instigated 194,379 live marketing calls between April 2024 and April 2025 to numbers registered with the Telephone Preference Service, leading to 61 complaints. An enforcement notice was also issued.
PECR, Reg. 21
Read the ICO decision on Bluon Energy Ltd -
£66k about €75k
Police Service of Scotland
Police Scotland bulk downloaded a witness's phone and later disclosed her data to the person she had complained about during a misconduct process, then reported the breach late. A fine and a reprimand were issued.
UK GDPR / DPA 2018 Part 3, Art. 5(1)(f), Art. 5(1)(c), Art. 25, Art. 32(1), Art. 33(1), DPA 2018 s35, DPA 2018 s37
Read the ICO decision on Police Service of Scotland -
£60k about €69k
DPP Law Ltd
The ICO found the law firm had inadequate security for the personal data it held and did not notify a personal data breach to the ICO in time.
UK GDPR, Art. 5(1)(f), Art. 32(1), Art. 32(2), Art. 33(1)
Read the ICO decision on DPP Law Ltd -
£7,500 about €8,772
The Central Young Men's Christian Association
An email to people on a programme for those living with HIV used CC instead of BCC, so 166 recipients could be identified and their HIV status inferred. A reprimand was issued alongside the fine.
UK GDPR
Read the ICO decision on The Central Young Men's Christian Association
Orders, reprimands and findings
-
Order or finding
Bonne Terre Limited t/a Sky Betting and Gaming
Between January and March 2023 skybet.com placed 40 third-party marketing cookies before visitors made a choice in the consent banner, so their data reached adtech vendors without consent. The ICO issued a reprimand, not a fine.
UK GDPR, Art. 5(1)(a), Art. 6(1)(a), Art. 7(1)
Read the ICO decision on Bonne Terre Limited t/a Sky Betting and Gaming -
Order or finding
Chelmer Valley High School
The school introduced facial recognition for cashless canteen payments without first completing a data protection impact assessment, and received a reprimand.
UK GDPR, Art. 35(1)
Read the ICO decision on Chelmer Valley High School -
Order or finding
Serco Leisure Operating Limited and associated trusts
Enforcement notices ordered Serco Leisure, Serco Jersey and seven leisure trusts to stop using facial recognition and fingerprint scanning to track attendance of more than 2,000 staff at 38 sites, which the ICO found unlawful.
UK GDPR
Read the ICO decision on Serco Leisure Operating Limited and associated trusts
Laws, deadlines and guidance
-
Law and guidance
ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening | ICO
On 30 September 2026 the office of the Information Commissioner was replaced by the Information Commission, a body led by a board, which now carries out the regulator's functions. Day to day enforcement and guidance continue.
Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026
Read the ICO decision on ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening | ICO -
Law and guidance
Final storage and access technologies guidance published | ICO
The ICO issued final guidance on storage and access technologies, covering cookies, tracking pixels, fingerprinting and similar tools and reflecting the Data (Use and Access) Act changes. A separate review of the regulation 6 consent rule for online advertising was passed to government as advice in May 2026.
PECR / UK GDPR, Reg. 6
Read the ICO decision on Final storage and access technologies guidance published | ICO -
Law and guidance
The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026
From 5 February 2026 most UK GDPR and PECR reforms took effect, including recognised legitimate interests, new automated decision rules, revised rules on storing information on user devices and new PECR enforcement powers allowing fines up to the UK GDPR higher maximum of £17.5m or 4% of worldwide turnover. The duty to handle data subject complaints followed on 19 June 2026.
Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), DUAA s70, DUAA s80, DUAA s103, DUAA s112, DUAA s115, DUAA Sch 12, DUAA Sch 13, DPA 2018 s157
Read the DSIT decision on The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 -
Law and guidance
ICO action secures increased cookie compliance, giving millions stronger control over their personal information online | ICO
The ICO tested the UK's top 1,000 websites for ad cookies set before consent, rejecting being harder than accepting, and cookies set without consent; 979 passed at last test, 564 of them only after ICO letters, investigations or 17 preliminary enforcement notices. By April 2026 the ICO put compliance at 99%.
PECR, Reg. 6
Read the ICO decision on ICO action secures increased cookie compliance, giving millions stronger control over their personal information online | ICO -
Law and guidance
Data Use and Access Act 2025: plans for commencement (GOV.UK)
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is being commenced in stages: technical provisions from August 2025, most data protection and PECR changes on 5 February 2026, the data subject complaints duty on 19 June 2026 and the ICO governance change on 30 September 2026.
Data (Use and Access) Act 2025
Read the DSIT decision on Data Use and Access Act 2025: plans for commencement (GOV.UK) -
Law and guidance
ICO takes action to tackle cookie compliance across the UK's top 1,000 websites | ICO
The ICO published guidance on consent or pay models, where users either accept personalised ads or pay for an ad-free service, with factors to show consent is freely given. In September 2025 it welcomed Meta moving UK Facebook and Instagram users to such a model at a lower price than in the EU.
UK GDPR / PECR
Read the ICO decision on ICO takes action to tackle cookie compliance across the UK's top 1,000 websites | ICO
Would your website pass?
The free Trust Center scan checks the failures behind these decisions: trackers before consent, advertising pixels, security headers, where visitor data goes, privacy requests and AI tools.
How this list is built
- Every record links to the regulator's own decision, press release, the official journal or a court judgment. Trackers and news coverage are used only to find cases.
- The amount, date and organisation were read on that page. Where a regulator first proposed a different amount, the final one is shown.
- Status follows the regulator: final, reduced, or under appeal. Decisions overturned in court are removed from this list.
- Summaries are our own words and describe what the regulator found. They are not legal advice.
- Conversions use the European Central Bank reference rate on the decision date. The data is also available as JSON at /api/fines.