31
Actions published
14% of the register
14
Monetary penalties
10 with a published figure
£21,092,283
Penalties published
sum of stated amounts
£14,000,000
Largest single penalty
Capita plc and Capita Pension Solutions Ltd
10
Sectors represented
3 laws named
2025 in one paragraph
The ICO published 31 enforcement actions dated 2025, 21 fewer than in 2024. They break down as 14 monetary penalties, 9 enforcement notices and 8 reprimands. 15 name the UK GDPR and 11 were taken under PECR, the separate marketing and electronic-communications rules, carrying £340,000 of the year's published penalties between them. A PECR penalty is not a GDPR fine, and the two are counted apart everywhere on this register.
01Largest penalties of 2025
| # | Organisation | Date | Action | Law | Penalty |
|---|---|---|---|---|---|
| 1 | Capita plc and Capita Pension Solutions Ltd | 15 Oct 2025 | Monetary penalty | UK GDPR | £14,000,000 |
| 2 | Advanced Computer Software Group Limited | 26 Mar 2025 | Monetary penalty | Not stated | £3,070,000 |
| 3 | 23andMe | 5 Jun 2025 | Monetary penalty | UK GDPR | £2,310,000 |
| 4 | LastPass UK Ltd | 20 Nov 2025 | Monetary penalty | UK GDPR | £1,228,283 |
| 5 | Bharat Singh Chand | 16 Sep 2025 | Monetary penalty | PECR 2003 | £200,000 |
| 6 | AFK Letters Co Ltd | 27 Mar 2025 | Monetary penalty | PECR 2003 | £90,000 |
| 7 | Police Service of Scotland | 12 Dec 2025 | Monetary penalty | UK GDPR | £66,000 |
| 8 | DPP Law Ltd | 14 Apr 2025 | Monetary penalty | UK GDPR | £60,000 |
| 9 | Darian Bishop trading as ECO4U | 24 Apr 2025 | Monetary penalty | PECR 2003 | £50,000 |
| 10 | Birthlink | 24 Jun 2025 | Monetary penalty | UK GDPR | £18,000 |
2025 by action type
- Monetary penalty14 (45%)
- Enforcement notice9 (29%)
- Reprimand8 (26%)
2025 by law
- UK GDPR15 (48%)
- PECR 200311 (35%)
- Not stated5 (16%)
2025 by sector
- General business6 (21%)
- Criminal justice5 (17%)
- Sector not stated5 (17%)
- Utilities4 (14%)
- Local government4 (14%)
- Marketing3 (10%)
- Health1 (3%)
02Every 2025 action
03Other years
04Read across the site
The EU and UK decision register
Major GDPR fines across the EEA and the UK, with the amounts, articles and appeal status.
Enforcement statistics
Totals by year, country and violation across the wider decision register.
Article 83 calculator
Put your own turnover and infringement type against the statutory caps.
Provenance and independence
Source: ICO enforcement register (ico.org.uk/action-weve-taken/enforcement/), as published on 4 September 2026. Contains public sector information licensed under the Open Government Licence v3.0.
GDPRFine.com is an independent tracker of ICO enforcement. It is not affiliated with, endorsed by or connected to the Information Commissioner's Office, and it uses no ICO branding. Where the ICO's own wording is reproduced it is quoted and attributed; everything else on these pages is our own summary of the published record.
The ICO's register held 222 entries on that date. 6 of them are prosecutions of named individuals, with ages and home towns in the ICO's own summary. This tracker indexes organisations, so those 6 are excluded and every count on these pages is out of 216. They remain on the ICO's own register.
An entry says what the Commissioner did on the date shown. It is not a statement about the organisation today, and the ICO can amend or remove a register entry at any time. Amounts and provisions are as published by the ICO; where the published notice does not state a figure or name a provision, these pages say so rather than filling the gap.
Register: ico.org.uk/action-weve-taken/enforcement/. Corrections: questions@gdprfine.com.