ICO Enforcement Actions
Information Commissioner's Office enforcement actions — monetary penalties, enforcement notices, reprimands, and undertakings for data protection and FOI failures.
211
Total Actions
58
Monetary Penalties
£51,139,873
Total Fines (£)
Actions by Type
Key Insights
The ICO has taken 211 enforcement actions tracked here, including 58 monetary penalties and 100 reprimands. Total fines: £51,139,873.
Public bodies subject to ICO enforcement — NHS trusts, police forces, councils — can be cross-referenced with their inquiry recommendation delivery records to surface patterns between governance failures and accountability gaps.
Showing 211 actions
The Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust
The Information Commissioner’s Office (ICO) has issued an enforcement notice to Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust for its poor handling of requests made under the Freedom of …
23 Mar 2026
The Queen Elizabeth Hospital, King's Lynn, NHS Foundation Trust
ICO
The University Hospitals Birmingham NHS Foundation Trust
The Information Commissioner’s Office (ICO) has issued an enforcement notice to University Hospitals Birmingham NHS Foundation Trust for its poor handling of requests made under the Freedom of Information Act …
23 Mar 2026
University Hospitals Birmingham NHS Foundation Trust
ICO
Reddit, Inc.
We imposed a £14,472,500.00 penalty to Reddit, Inc. for infringing Articles 5(1)(a), 6, and 8, and Article 35 of the UK GDPR. We found that Reddit, Inc.:
23 Feb 2026
£14,472,500
ICO
Calderdale Council
20 Feb 2026
Calderdale Council
ICO
The Commissioner of Police for the City of London
A reprimand has been issued to The Commissioner of Police for the City of London (COLP), after it failed to meet its data protection obligations in responding to SARs within …
20 Feb 2026
ICO
North Tees and Hartlepool NHS Foundation Trust
12 Feb 2026
North Tees and Hartlepool NHS Foundation Trust
ICO
Christopher Munro and William Chipoma
Two further people have been convicted following our extensive investigation into the unlawful accessing and sale of personal information obtained from over 400 garages across the UK, as well as …
11 Feb 2026
ICO
Chief Constable of Cumbria Constabulary
05 Feb 2026
ICO
MediaLab.AI, Inc.
£247,590 penalty imposed on MediaLab.AI, Inc. in respect of infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR. MediaLab operated the Imgur social media platform in the UK prior …
04 Feb 2026
£247,590
ICO
TMAC Ltd
TMAC contravened regulations 21 and 24 of PECR and the ICO issued a monetary penalty of £100,000 and an enforcement notice.
03 Feb 2026
£100,000
ICO
TMAC Ltd
TMAC contravened regulations 21 and 24 of PECR and the ICO issued a monetary penalty of £100,000 and an enforcement notice.
03 Feb 2026
ICO
London Borough of Lambeth
29 Jan 2026
London Borough of Lambeth
ICO
Home Office
27 Jan 2026
Home Office
ICO
Allay Claims Ltd
MPN and EN issued to Allay Claims Ltd due to a large volume of unsolicited SMS being sent, promoting PPI tax refund services
15 Jan 2026
ICO
Allay Claims Ltd
MPN and EN issued to Allay Claims Ltd due to a large volume of unsolicited SMS being sent, promoting PPI tax refund services
15 Jan 2026
ICO
Staines Health Group
Reprimand Issued - Staines Health Group sent excessive medical details about a terminally ill patient to their insurance company. The patient requested that five years of medical records be sent …
16 Dec 2025
Environment Agency
ICO
Police Service of Scotland
The Information Commissioner's Office (ICO) has fined the Police Service of Scotland £66,000 and issued a Reprimand for serious failures in the handling of sensitive personal information.
12 Dec 2025
£66,000
Committee on Toxicity of Chemicals in Food, Consumer Products and the Environment
ICO
ZMLUK Limited
ZMLUK Limited were issued with an MPN due to sending unsolicited emails promoting energy saving products.
11 Dec 2025
ICO
Post Office Limited
On 25 April 2024, Post Office Limited (POL) uploaded an unredacted copy of a legal Settlement Deed to its corporate website instead of the intended redacted version. The Settlement Deed …
02 Dec 2025
Independent Case Examiner
ICO
LastPass UK Ltd
£1,228,283 penalty issued to password management provider LastPass UK Ltd on 20 November 2025 in respect of infringements of Article 5(1)(f) and Article 32(1)(f) UK GDPR. LastPass' failure to implement …
20 Nov 2025
£1,228,283
The Pensions Advisory Service
ICO
London Borough of Redbridge
18 Nov 2025
London
ICO
Lead Pronto Ltd
Lead Pronto Ltd were issued with an MPN and an EN due to sending unsolicited SMS promoting Government funded boiler grants.
06 Nov 2025
Environment Agency
ICO
Lead Pronto Ltd
Lead Pronto Ltd were issued with an MPN and an EN due to sending unsolicited SMS promoting Government funded boiler grants.
06 Nov 2025
Environment Agency
ICO
Capita plc and Capita Pension Solutions Ltd
The Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m following a cyber attack in April 2023 which saw hackers gain access to over …
15 Oct 2025
£14,000,000
Capita
ICO
Qonain Hussain
A former insurance claims advisor has been sentenced for unlawfully accessing personal injury claim records.
08 Oct 2025
ICO
Bharat Singh Chand
Bharat Singh Chand is a self-employed lead generator. Between 3 December 2023 and 3 July 2024, he sent or instigated the sending of 966,449 direct marketing SMS messages in breach …
16 Sep 2025
Highways Agency
ICO
Bharat Singh Chand
Bharat Singh Chand is a self-employed lead generator. Between 3 December 2023 and 3 July 2024, he sent or instigated the sending of 966,449 direct marketing SMS messages in breach …
16 Sep 2025
£200,000
Highways Agency
ICO
Jason Blake
The director of a care home in Bridlington, Yorkshire, has been fined for refusing to respond to a request for a resident’s personal information – known as a subject access …
03 Sep 2025
British Library
ICO
Green Spark Energy Ltd
Green Spark Energy Ltd (GSE) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends in relation to the energy and …
28 Aug 2025
EE
ICO
Green Spark Energy Ltd
Green Spark Energy Ltd (GSE) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends in relation to the energy and …
28 Aug 2025
EE
ICO
Home Improvement Marketing Ltd
Home Improvement Marketing Ltd (HIML) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends in relation to the energy and …
28 Aug 2025
ENT
ICO
Home Improvement Marketing Ltd
Home Improvement Marketing Ltd (HIML) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends in relation to the energy and …
28 Aug 2025
ENT
ICO
Bristol City Council
The Information Commissioner’s Office (ICO) has issued an enforcement notice to Bristol City Council (BCC) for failing to comply with its legal obligations to respond to people who asked for …
27 Aug 2025
Bristol City Council
ICO
Birthlink
The Information Commissioner’s Office (ICO) has fined Scottish charity Birthlink £18,000 after it destroyed approximately 4,800 personal records, up to ten percent of which may be irreplaceable.
24 Jun 2025
£18,000
ICO
South Yorkshire Police
A reprimand has been issued to South Yorkshire Police for failing to ensure it had appropriate technical security and organisation measures in place which led to the accidental deletion of …
06 Jun 2025
South Yorkshire Police
ICO
23andMe
The Information Commissioner has fined 23andMe, Inc £2,310,000 for infringements of Articles 5(1)(f) and 32(1) of the UK GDPR between 25 May 2018 and 31 December 2024.23andMe failed to implement …
05 Jun 2025
£2,310,000
ICO
London Borough of Hammersmith and Fulham
We issued a reprimand to the London Borough of Hammersmith and Fulham after hidden data within a spreadsheet was inadvertently disclosed in response to a Freedom of Information Act request. …
16 May 2025
Highways Agency
ICO
Darian Bishop trading as ECO4U
Between 9 January 2023 to 9 October 2023, there were 194,110 unsolicited direct marketing calls made to subscribers who were registered with the TPS and who had not notified Darian …
24 Apr 2025
Advanced Research and Invention Agency
ICO
Darian Bishop trading as ECO4U
Between 9 January 2023 to 9 October 2023, there were 194,110 unsolicited direct marketing calls made to subscribers who were registered with the TPS and who had not notified Darian …
24 Apr 2025
Advanced Research and Invention Agency
ICO
DPP Law Ltd
The Information Commissioner has fined law firm DPP Law Ltd £60,000 for its infringements of Articles 5(1)(f), 32(1), 32(2) and 33(1) of the UK GDPR between 25 May 2018 and …
14 Apr 2025
£60,000
ICO
AFK Letters Co Ltd
It was found that between January and September 2023, AFK made 95,277 spam calls resulting in several complaints being made to the ICO and TPS. AFK did not provide evidence …
27 Mar 2025
ICO
AFK Letters Co Ltd
It was found that between January and September 2023, AFK made 95,277 spam calls resulting in several complaints being made to the ICO and TPS. AFK did not provide evidence …
27 Mar 2025
£90,000
ICO
Advanced Computer Software Group Limited
The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (Advanced) £3.07m for security failings that put the personal information of 79,404 people at risk.
26 Mar 2025
£3,070,000
Committee on Mutagenicity of Chemicals in Food, Consumer Products and the Environment
ICO
Greater Manchester Police
We issued a reprimand to Greater Manchester Police for failing to ensure that appropriate technical or organisational measures were in place to protect the accidental loss of CCTV data and …
14 Mar 2025
Greater Manchester Police
ICO
Smart Home Ensured Limited
Between 4 July 2023 to 24 August 2023 Smart Home Ensured Limited made 14,508 unsolicited calls for direct marketing purposes in breach of Regulation 21 of PECR. The company has …
19 Feb 2025
Office of Manpower Economics
ICO
Glasgow City Council
A reprimand was issued to Glasgow City Council as during the period between 01 April 2023 to 01 March 2024, they responded to 45% of incoming subject access requests within …
04 Feb 2025
Crossrail International
ICO
City of Edinburgh Council
A reprimand was issued to City of Edinburgh Council as during the period between 01 January 2023 to 31 December 2023, it had failed to respond to 40% of Subject …
03 Feb 2025
City of Edinburgh Council
ICO
United Lincolnshire Teaching Hospitals NHS Trust
A reprimand was issued to United Lincolnshire Teaching Hospitals NHS Trust as during the period between 01 March 2021 to 31 March 2022, it had failed to respond to 32% …
13 Dec 2024
Environment Agency
ICO
Money Bubble Ltd EN
It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to the ICO and TPS. MBL did not …
12 Dec 2024
British Library
ICO
Money Bubble Ltd MPN
It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to the ICO and TPS. MBL did not …
12 Dec 2024
£120,000
British Library
ICO