DM-10 Response Not Accepted

Custodial sentences for data protection offences

Recommendation

Given the potential seriousness of such offences, it is recommended that the Government take an early opportunity to amend the Data Protection Act 2018 to provide for sentences of imprisonment for offenders.

Published Evidence Summary
The following publicly available evidence relates to this recommendation:
The government has not accepted this recommendation.
Sources
Government response (2023-06-22): Not Accepted Source: https://www.gov.uk/government/publications/government-response-to-the-daniel-morgan-report/government-response-to-the-report-of-the-daniel-morgan-independent-panel Text: The Data Protection Act 2018 has already, however, strengthened criminal sanctions. The offence of unlawfully obtaining data was widened to include the unlawful retention of data. The maximum penalty for a person convicted of that offence is an unlimited fine. The 2018 Act also made changes to make Progress update (2023-06-22): Not Accepted Status as of Government Response (June 2023): Not Started Source: https://www.gov.uk/government/publications/government-response-to-the-daniel-morgan-report
How was this evidence gathered?
Evidence searched by baseline-data-v1 on 26 May 2026
Checked data held on this site (government responses, progress updates, independent evidence)
External sources searched: www.gov.uk
Jurisdiction
England
Section Reference
Volume 1
Response
Not Accepted
Not Accepted Home Office
22 Jun 2023

The Data Protection Act 2018 has already, however, strengthened criminal sanctions. The offence of unlawfully obtaining data was widened to include the unlawful retention of data. The maximum penalty for a person convicted of that offence is an unlimited fine. The 2018 Act also made changes to make the offences recordable for the first time. Consequently, having carefully considered the evidence, the Government does not feel that the introduction of custodial sentences would be a proportionate response to data protection offences at this time.

Read Full Response
Source
Inquiry Daniel Morgan Panel
Report The Report of the Daniel Morgan Independent Panel 15 Jun 2021
View Source
Responsible Bodies
Home Office Primary
Themes & Tags
Personal data privacy risks Police tech abuse response Data Protection Legislation Sentencing
Recommendation age 5.0 yrs
Last formal update 1074 days ago