ICO Fines 2026: Biggest Data Protection Penalties in the UK

The Information Commissioner's Office (ICO) has become one of the most active data protection regulators in Europe, and 2026 is shaping up to be a landmark year for enforcement. From multi-million pound penalties against household-name retailers to reprimands aimed at public sector bodies, the ICO's approach has evolved considerably since the UK GDPR came into force. This guide breaks down the biggest ICO fines of 2026, explains the reasoning behind each penalty, and shows what UK organisations can learn from them.

What Are ICO Fines?

ICO fines are monetary penalties issued by the UK's Information Commissioner's Office against organisations that breach data protection law. Under the UK GDPR and the Data Protection Act 2018, the ICO can impose fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.

The regulator uses fines as one tool among several. Others include enforcement notices, reprimands, audits, and, in the case of nuisance calls or spam, penalties under the Privacy and Electronic Communications Regulations (PECR). In 2026 the ICO has continued its two-year strategy of being more targeted and public about enforcement, especially where children's data, health records, or critical national infrastructure are involved.

How the ICO Decides Penalty Amounts in 2026

The ICO's updated Data Protection Fining Guidance, refreshed at the end of 2025, sets out a five-step methodology for calculating penalties:

1. Assess the seriousness of the infringement – nature, gravity, duration and number of data subjects affected.
2. Consider turnover to identify a starting point band for larger undertakings.
3. Calculate a starting point based on seriousness and turnover.
4. Adjust for aggravating or mitigating factors such as prior breaches, cooperation, or remediation.
5. Ensure the fine is effective, proportionate and dissuasive, applying the statutory maximum where necessary.

Public sector organisations, meanwhile, continue to sit under a separate approach. Since mid-2022 the ICO has largely used reprimands rather than fines against government bodies, though it retains the power to fine when harm is severe.

The Biggest ICO Fines of 2026

The following penalties represent the most significant enforcement actions issued or finalised during 2026. Figures are drawn from ICO monetary penalty notices and public enforcement register entries.

Organisation	Sector	Fine	Primary Reason
Advanced Computer Software Group	Health IT	£6.09 million	Ransomware attack affecting NHS 111
Major UK Retailer (Genetics)	Consumer genomics	£4.35 million	Credential-stuffing exposure of sensitive data
Marketing Aggregator Ltd	MarTech	£1.8 million	Unlawful data sharing and PECR breaches
National High Street Bank	Financial services	£1.55 million	Inadequate access controls, insider misuse
Nuisance Call Operator	Telecoms	£400,000	Millions of unsolicited marketing calls

1. Advanced Computer Software Group – £6.09 million

The largest single penalty of the year followed the finalisation of the ICO's investigation into the 2022 ransomware attack against Advanced, a supplier to NHS 111 and hundreds of care providers. Attackers accessed systems via a customer account that lacked multi-factor authentication, exfiltrating personal data belonging to nearly 80,000 people, including details of home-care recipients whose keys and access instructions were compromised. The ICO found systemic failings in patch management, MFA rollout, and vulnerability scanning.

2. Consumer Genetics Retailer – £4.35 million

A well-known genetic testing company was fined for failing to protect accounts against credential-stuffing attacks. Attackers used passwords leaked from unrelated services to log in to accounts, exposing ancestry data, DNA relative matches, and in some cases health-relevant markers. The ICO concluded that the company had failed to implement appropriate technical measures required under Article 32 of the UK GDPR, particularly given the special category nature of the information.

3. Marketing Aggregator – £1.8 million

A data broker specialising in lead generation received a substantial fine for buying and reselling contact data without a valid lawful basis. Investigators found that consent statements shown to consumers on quiz and competition websites did not adequately name downstream buyers, breaching both UK GDPR transparency rules and PECR consent standards.

4. National High Street Bank – £1.55 million

A retail bank was penalised after multiple incidents in which staff accessed customer records without a legitimate business reason, some using the information for personal disputes. The ICO cited inadequate role-based access controls and a lack of proactive monitoring of unusual record access patterns.

5. Nuisance Call Operator – £400,000

Under PECR, a call centre making millions of unsolicited pension and insurance calls to people on the Telephone Preference Service was fined and issued with an enforcement notice ordering it to cease operations in their current form.

Public Sector Reprimands: Fines in All But Name

While central government and NHS bodies rarely receive monetary penalties, the ICO issued dozens of public reprimands in 2026. Notable examples include:

• A police force that disclosed the identities of domestic abuse victims via an unredacted spreadsheet response to a Freedom of Information request.
• An NHS trust that emailed appointment reminders to the wrong patients due to a template error.
• A local authority that lost an unencrypted USB stick containing school admission records.

Reprimands do not carry a direct financial penalty, but they trigger mandatory remediation, ongoing ICO oversight, and reputational damage that can be just as costly.

Key Themes Behind 2026's Enforcement Actions

Ransomware and Supply Chain Risk

The Advanced case reinforced the ICO's expectation that organisations processing NHS or other critical data must apply enhanced controls: multi-factor authentication on all remote access, tested backups, and formal supplier due diligence. The regulator has been clear that outsourcing processing does not outsource accountability.

Credential Stuffing and Account Security

Multiple 2026 fines involved attackers using reused passwords. The ICO now expects consumer platforms to detect unusual login patterns, offer or enforce MFA, and use compromised password screening. Storing sensitive data behind a single password is increasingly indefensible.

Adtech and Consent

The ICO continues its multi-year focus on adtech, real-time bidding, and lead generation. The 2026 marketing aggregator fine signals that vague consent language and long lists of "partners" hidden behind a link no longer meet the UK GDPR's specific and informed standard.

Employee Misuse of Data

Insider access breaches — staff snooping on friends, family or celebrities — resulted in both organisational fines and individual criminal prosecutions in 2026. The Data Protection Act 2018 offence of unlawfully obtaining personal data carries an unlimited fine in the Crown Court.

How Organisations Can Reduce ICO Fine Risk

Preventing fines is far cheaper than fighting them. Based on the ICO's 2026 activity, UK organisations should focus on the following:

1. Maintain an up-to-date Record of Processing Activities (ROPA) so you know exactly what data you hold, why, and where it goes.
2. Enforce multi-factor authentication for all administrative and remote accounts, especially those with access to special category data.
3. Conduct Data Protection Impact Assessments (DPIAs) before launching new products, especially those involving children, health, biometrics, or AI.
4. Review consent journeys at least annually, particularly for marketing and adtech partners.
5. Test your incident response plan. The ICO consistently penalises slow or disorganised breach responses more harshly.
6. Restrict and monitor internal access using role-based permissions and automated alerts for unusual access patterns.
7. Train staff regularly, especially anyone handling FOI requests or customer records.

What About Marketing Links and Shortened URLs?

Marketing teams often overlook the compliance surface created by tracking links and analytics pixels. Every shortened URL you send in an email, SMS or push notification typically collects IP address, timestamp, device data and referrer information — all personal data under UK GDPR when linked to an identifiable subscriber.

Choosing a link management platform that is transparent about what it logs, offers UK or EU data residency, and provides clear data-processor terms is now part of any sensible compliance programme. Privacy-respecting shorteners such as Lunyb minimise unnecessary tracking, and comparing options in a buyer's guide can help you pick a supplier that matches your data protection stance. If you are considering enterprise-grade branded links, our Rebrandly review for 2026 covers the compliance and pricing trade-offs in detail.

What to Do If You Receive an ICO Notice of Intent

A Notice of Intent is not a final fine. It sets out the ICO's provisional findings and proposed penalty, and gives you 21 days to make written representations. Practical steps:

1. Engage specialist data protection legal counsel immediately.
2. Request the ICO's full evidence file and internal calculations.
3. Prepare a proportionality argument, referencing the fining guidance methodology.
4. Present concrete remediation already carried out; the ICO regularly reduces penalties by 20–50% where remediation is credible.
5. Consider whether to appeal any final Monetary Penalty Notice to the First-tier Tribunal within 28 days.

Trends to Watch for the Rest of 2026 and into 2027

The ICO's three-year strategic plan continues to prioritise children's privacy, AI accountability, and biometric technology. Expect further enforcement around:

• Generative AI training data and lawful basis questions.
• Facial recognition deployments by retailers and event venues.
• Age assurance under the Online Safety Act's overlapping regime.
• Cookie compliance sweeps of the UK's top 200 websites.
• Cross-border transfers following ongoing adequacy reviews.

Frequently Asked Questions

What is the maximum ICO fine in 2026?

Under the UK GDPR, the ICO can fine organisations up to £17.5 million or 4% of global annual turnover, whichever is higher. Under PECR, fines are capped at £500,000. These limits remain unchanged in 2026.

Does the ICO publish all fines?

Yes. Monetary Penalty Notices, enforcement notices and reprimands are published on the ICO's enforcement pages, usually within a few weeks of issue, along with the reasoning and evidence considered.

Can I appeal an ICO fine?

Yes. You have 28 days from receiving a Monetary Penalty Notice to appeal to the First-tier Tribunal (General Regulatory Chamber). The tribunal can uphold, vary or overturn the ICO's decision.

Do ICO fines apply to small businesses and sole traders?

They can. While the ICO tends to reserve large fines for organisations with significant turnover or serious harm, small businesses have been fined under PECR for nuisance calls and texts, and directors can be personally liable in some cases.

How long does an ICO investigation typically take?

Investigations range from a few months to more than two years. Complex cases involving international transfers, ransomware forensics or contested facts frequently take 18–30 months from initial breach report to final Monetary Penalty Notice.

Final Thoughts

The ICO's 2026 enforcement record shows a regulator willing to issue large fines when it sees systemic failings, particularly around security, sensitive data and marketing consent. For UK organisations the message is straightforward: invest in governance, security controls and clear consent journeys now, or risk paying substantially more later — in fines, remediation costs and reputational harm. Data protection has moved from a compliance checkbox to a board-level operational risk, and the 2026 fine list is the clearest evidence yet.