21
Actions published
10% of the register
10
Monetary penalties
8 with a published figure
£16,643,990
Penalties published
sum of stated amounts
£14,472,500
Largest single penalty
Reddit, Inc.
8
Sectors represented
4 laws named
2026 in one paragraph
The ICO published 21 enforcement actions dated 2026, 10 fewer than in 2025. They break down as 10 monetary penalties, 8 enforcement notices and 3 reprimands. 5 name the UK GDPR and 12 were taken under PECR, the separate marketing and electronic-communications rules, carrying £960,000 of the year's published penalties between them. A PECR penalty is not a GDPR fine, and the two are counted apart everywhere on this register.
01Largest penalties of 2026
| # | Organisation | Date | Action | Law | Penalty |
|---|---|---|---|---|---|
| 1 | Reddit, Inc. | 23 Feb 2026 | Monetary penalty | UK GDPR | £14,472,500 |
| 2 | South Staffordshire Plc and South Staffordshire Water Plc | 7 May 2026 | Monetary penalty | UK GDPR | £963,900 |
| 3 | KRA Consultancy Ltd | 20 May 2026 | Monetary penalty | PECR 2003 | £300,000 |
| 4 | MediaLab.AI, Inc. | 4 Feb 2026 | Monetary penalty | UK GDPR | £247,590 |
| 5 | Thermotech Wall and Loft Surveys Ltd | 28 May 2026 | Monetary penalty | PECR 2003 | £240,000 |
| 6 | Elderly Aids Limited | 6 Aug 2026 | Monetary penalty | PECR 2003 | £190,000 |
| 7 | Jacksons Marketing Ltd | 12 Mar 2026 | Monetary penalty | PECR 2003 | £130,000 |
| 8 | TMAC Ltd | 3 Feb 2026 | Monetary penalty | PECR 2003 | £100,000 |
2026 by action type
- Monetary penalty10 (48%)
- Enforcement notice8 (38%)
- Reprimand3 (14%)
2026 by law
- PECR 200312 (57%)
- UK GDPR5 (24%)
- Data Protection Act 20182 (10%)
- Not stated2 (10%)
2026 by sector
- General business5 (24%)
- Sector not stated4 (19%)
- Criminal justice3 (14%)
- Marketing2 (10%)
- Utilities2 (10%)
- Central government1 (5%)
02Every 2026 action
03Other years
04Read across the site
The EU and UK decision register
Major GDPR fines across the EEA and the UK, with the amounts, articles and appeal status.
Enforcement statistics
Totals by year, country and violation across the wider decision register.
Article 83 calculator
Put your own turnover and infringement type against the statutory caps.
Provenance and independence
Source: ICO enforcement register (ico.org.uk/action-weve-taken/enforcement/), as published on 4 September 2026. Contains public sector information licensed under the Open Government Licence v3.0.
GDPRFine.com is an independent tracker of ICO enforcement. It is not affiliated with, endorsed by or connected to the Information Commissioner's Office, and it uses no ICO branding. Where the ICO's own wording is reproduced it is quoted and attributed; everything else on these pages is our own summary of the published record.
The ICO's register held 222 entries on that date. 6 of them are prosecutions of named individuals, with ages and home towns in the ICO's own summary. This tracker indexes organisations, so those 6 are excluded and every count on these pages is out of 216. They remain on the ICO's own register.
An entry says what the Commissioner did on the date shown. It is not a statement about the organisation today, and the ICO can amend or remove a register entry at any time. Amounts and provisions are as published by the ICO; where the published notice does not state a figure or name a provision, these pages say so rather than filling the gap.
Register: ico.org.uk/action-weve-taken/enforcement/. Corrections: questions@gdprfine.com.