EU Regulation 2016/679 - Decision Register

UK / INFORMATION COMMISSIONER/216 ACTIONS

The ICO enforcement register

Every action the UK Information Commissioner publishes, indexed by year, sector and the law it was actually taken under. 45 of the 64 penalties here are PECR marketing penalties, not GDPR fines, and this register keeps the two apart.

216

Actions on the register

148 with a page here

64

Monetary penalties

44 with a published figure

£53,623,773

Published penalty total

median £120,000

45

PECR, not GDPR

£3,060,000 of the total

4 September 2026

Register snapshot

5 years, 20 sectors

The short version

The ICO publishes 222 enforcement actions on its register, dated 22 January 2022 to 7 August 2026; 6 are prosecutions of named individuals and are left out here, so this tracker covers 216 actions against organisations. Most of them are reprimands: formal criticism with no fine attached, 97 entries in all (45%). Only 64 are monetary penalties, and 45 of those were issued under PECR, the marketing and electronic-communications rules, rather than the UK GDPR. The published penalties that state a figure come to £53,623,773, with a median of £120,000. UK enforcement is high in volume and low in value compared with the headline EU decisions indexed on the main register.

01Why the law matters more than the headline

UK GDPR

95

actions naming the UK GDPR, 13 of them monetary penalties worth £47,173,773 where published. Maximum: £17.5 million or 4% of total worldwide annual turnover, whichever is higher.

PECR 2003

87

actions under the Privacy and Electronic Communications Regulations 2003: nuisance calls, unsolicited texts and emails, cookies. 45 monetary penalties worth £3,060,000. Maximum: £500,000. These are not GDPR fines and are never presented as such here.

02Latest actions

The 15 most recent entries, newest first
OrganisationDateActionLawPenaltySector
ACRO Criminal Records Office7 Aug 2026ReprimandUK GDPR-Central government
Elderly Aids Limited6 Aug 2026Monetary penaltyPECR 2003£190,000General business
Elderly Aids Limited6 Aug 2026Enforcement noticePECR 2003-General business
Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS)27 Jul 2026Enforcement noticeData Protection Act 2018-Criminal justice
Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS)27 Jul 2026ReprimandData Protection Act 2018-Criminal justice
Thermotech Wall and Loft Surveys Ltd28 May 2026Monetary penaltyPECR 2003£240,000Sector not stated
Thermotech Wall and Loft Surveys Ltd28 May 2026Enforcement noticePECR 2003-Sector not stated
KRA Consultancy Ltd20 May 2026Enforcement noticePECR 2003-Marketing
KRA Consultancy Ltd20 May 2026Monetary penaltyPECR 2003£300,000Marketing
South Staffordshire Plc and South Staffordshire Water Plc7 May 2026Monetary penaltyUK GDPR£963,900Utilities
SA Assistance Ltd21 Apr 2026Enforcement noticePECR 2003-General business
Energy Prices Direct Limited30 Mar 2026Monetary penaltyPECR 2003-Utilities
Jacksons Marketing Ltd12 Mar 2026Monetary penaltyPECR 2003£130,000Sector not stated
Jacksons Marketing Ltd12 Mar 2026Enforcement noticePECR 2003-Sector not stated
Reddit, Inc.23 Feb 2026Monetary penaltyUK GDPR£14,472,500Online technology and telecoms

All 2026 actions

03Largest published penalties

Ranked by the amount the ICO published. 20 penalties on the register do not state a figure in the published entry and are not ranked.
#OrganisationDateActionLawPenaltySector
1Reddit, Inc.23 Feb 2026Monetary penaltyUK GDPR£14,472,500Online technology and telecoms
2Capita plc and Capita Pension Solutions Ltd15 Oct 2025Monetary penaltyUK GDPR£14,000,000Sector not stated
3TikTok Information Technologies UK Limited and TikTok Inc (TikTok)15 May 2023Monetary penaltyUK GDPR£12,700,000Online technology and telecoms
4Advanced Computer Software Group Limited26 Mar 2025Monetary penaltyNot stated£3,070,000General business
523andMe5 Jun 2025Monetary penaltyUK GDPR£2,310,000General business
6LastPass UK Ltd20 Nov 2025Monetary penaltyUK GDPR£1,228,283Online technology and telecoms
7South Staffordshire Plc and South Staffordshire Water Plc7 May 2026Monetary penaltyUK GDPR£963,900Utilities
8Police Service of Northern Ireland3 Oct 2024Monetary penaltyUK GDPR£750,000Criminal justice
9Ministry of Defence26 Feb 2024Monetary penaltyUK GDPR£350,000Central government
10KRA Consultancy Ltd20 May 2026Monetary penaltyPECR 2003£300,000Marketing
11MediaLab.AI, Inc.4 Feb 2026Monetary penaltyUK GDPR£247,590Online technology and telecoms
12Thermotech Wall and Loft Surveys Ltd28 May 2026Monetary penaltyPECR 2003£240,000Sector not stated
13Bharat Singh Chand16 Sep 2025Monetary penaltyPECR 2003£200,000Sector not stated
14ESL Consultancy Services Ltd5 Dec 2024Monetary penaltyNot stated£200,000Finance, insurance and credit
15Cover Appliance Ltd21 Sep 2023Monetary penaltyPECR 2003£200,000Marketing

By action type

  • Reprimand97 (45%)
  • Monetary penalty64 (30%)
  • Enforcement notice55 (25%)

By law relied on

Top sectors

04By year

2026

21

actions, £16,643,990 in penalties

2025

31

actions, £21,092,283 in penalties

2024

52

actions, £2,067,500 in penalties

2023

80

actions, £13,820,000 in penalties

2022

32

actions

05By sector

Sector not stated

35

actions, £14,820,000 in penalties

Marketing

28

actions, £1,180,000 in penalties

Criminal justice

26

actions, £816,000 in penalties

General business

20

actions, £5,990,000 in penalties

Local government

20

actions

Finance, insurance and credit

19

actions, £410,000 in penalties

Health

15

actions

Central government

14

actions, £350,000 in penalties

Utilities

11

actions, £1,243,900 in penalties

Online technology and telecoms

7

actions, £28,648,373 in penalties

Retail and manufacture

5

actions, £140,000 in penalties

Charitable and voluntary

4

actions, £25,500 in penalties

Education and childcare

3

actions

Legal

2

actions

Transport and leisure

2

actions

Land or property services

1

action

Media

1

action

Political

1

action

Regulators

1

action

Social care

1

action

06By law

UK GDPR95actionsPECR 200387actionsNot stated24actionsData Protection Act 20188actionsFreedom of Information Act 20002actions

07What each action type actually does

Monetary penalty64

A fine. The ICO issues a monetary penalty notice setting out the contravention and the sum payable. On this register 64 of 216 entries are monetary penalties (30%).

Enforcement notice55

An order to act. An enforcement notice requires the organisation to take, or stop taking, specified steps by a deadline, and failure to comply is itself an offence. On this register 55 of 216 entries are enforcement notices (25%).

Reprimand97

A formal criticism on the public record. A reprimand carries no fine and no order, but it is published and the ICO expects the shortcomings named in it to be fixed. On this register 97 of 216 entries are reprimands (45%).

08How the register is built

Where it comes from

The ICO's own enforcement listing, read page by page, plus the notice PDF each entry links to. Nothing is taken from press coverage or third-party trackers.

How the law is decided

The statute shown is the one the ICO names in its own notice. Where a marketing case cites PECR regulations it is filed under PECR even if the notice also mentions the Data Protection Act, which carries the penalty machinery. Where no provision is named, the page says so.

Which entries get a page

148 of 216 entries carry enough published detail to support a page of their own. The remaining 68 are listed as rows on the year, sector and law pages, with the ICO's entry linked. Nothing is dropped and nothing is padded out.

FREQUENTLY ASKED

Common questions about ICO enforcement

How many enforcement actions does the ICO publish?
222 entries were on the ICO's enforcement register on 4 September 2026, dated between 22 January 2022 and 7 August 2026. 6 of them are prosecutions of named individuals, which this tracker does not index, leaving 216 actions against organisations: 97 reprimands, 64 monetary penalties and 55 enforcement notices. The register is the ICO's own published list; the ICO adds to it and removes from it, so the count moves.
Is an ICO fine the same as a GDPR fine?
Not always, and the difference matters. 45 of the 64 monetary penalties on the register were issued under PECR, the Privacy and Electronic Communications Regulations 2003, which govern marketing calls, texts, emails and cookies. PECR is a separate instrument from the UK GDPR, with a maximum penalty of £500,000 rather than the UK GDPR's £17.5 million or 4% of worldwide turnover. Calling a nuisance-call penalty a "GDPR fine" is wrong, and every page on this register labels the statute the ICO actually named.
What is the largest ICO penalty on the register?
Reddit, Inc., at £14,472,500, published on 23 February 2026 under UK GDPR. The median published penalty on the register is £120,000, so the largest entries are far above the typical one.
What is an ICO reprimand?
A reprimand is a formal criticism on the public record. A reprimand carries no fine and no order, but it is published and the ICO expects the shortcomings named in it to be fixed. It is the ICO's most common published action: 97 of the 216 entries here (45%). Because a reprimand carries no fine, a register dominated by reprimands is not a register of large sums, and reading enforcement volume as enforcement cost gets the UK picture badly wrong.
Which sectors does the ICO act against most?
Sector not stated leads with 35 actions (16%), followed by Marketing at 28 and Criminal justice at 26. The register uses the ICO's own 20-way sector classification, and 35 entries carry no sector at all.
Does an entry here mean an organisation is still in breach?
No. An entry records what the Commissioner did on the date shown. Enforcement notices set deadlines that are usually met, reprimands are formal criticism rather than a finding of continuing fault, and penalties can be appealed to the First-tier Tribunal. The ICO can also amend or remove a register entry. Read the linked notice before drawing any conclusion about an organisation today.
How far back does this register go?
To 22 January 2022. The ICO's published enforcement list is not a complete history of UK data protection enforcement: older actions, including the British Airways and Marriott penalties of 2020, are no longer carried on it. This tracker mirrors what the ICO publishes today and does not reconstruct entries the regulator has taken down.
Where does the data come from?
Directly from the ICO's enforcement listing at ico.org.uk/action-weve-taken/enforcement/ and the notice PDFs it links, read on 4 September 2026. ICO text is available under the Open Government Licence v3.0. Amounts and provisions are taken from the published notice; where the ICO does not state a figure or name a provision, these pages say so rather than estimating.

09Elsewhere on GDPRFine.com

Article 83 fine calculator

Estimate upper and lower tier exposure from turnover and infringement type.

EU and UK decision register

The major GDPR fines across the EEA and the UK, with amounts, articles and appeal status.

ICO profile

How the UK regulator works post-Brexit, and where the UK GDPR diverges from the EU regime.

How fines are calculated

The statutory factors and turnover caps behind every number on this register.

Appeals

What happens after a penalty notice, and how often regulators are overturned.

Fines by industry

Which sectors draw the largest penalties, across both regimes.

Provenance and independence

Source: ICO enforcement register (ico.org.uk/action-weve-taken/enforcement/), as published on 4 September 2026. Contains public sector information licensed under the Open Government Licence v3.0.

GDPRFine.com is an independent tracker of ICO enforcement. It is not affiliated with, endorsed by or connected to the Information Commissioner's Office, and it uses no ICO branding. Where the ICO's own wording is reproduced it is quoted and attributed; everything else on these pages is our own summary of the published record.

The ICO's register held 222 entries on that date. 6 of them are prosecutions of named individuals, with ages and home towns in the ICO's own summary. This tracker indexes organisations, so those 6 are excluded and every count on these pages is out of 216. They remain on the ICO's own register.

An entry says what the Commissioner did on the date shown. It is not a statement about the organisation today, and the ICO can amend or remove a register entry at any time. Amounts and provisions are as published by the ICO; where the published notice does not state a figure or name a provision, these pages say so rather than filling the gap. Refreshed by re-reading the ICO listing and the notices it links; the snapshot date on every page is the date of that read.

Register: ico.org.uk/action-weve-taken/enforcement/. Corrections: questions@gdprfine.com.

REGISTER UPDATED 2026-04-28