ICO Fines 2026: Biggest Data Protection Penalties in the UK

The Information Commissioner's Office (ICO) has continued its increasingly assertive enforcement stance throughout 2026, issuing some of the largest data protection penalties the UK has ever seen. From household-name retailers to nuisance-call operators and public sector bodies, no sector has been spared. This guide breaks down the biggest ICO fines in 2026, the reasoning behind them, and what British businesses must do to stay compliant under the UK GDPR and Data Protection Act 2018.

What Are ICO Fines and Who Can Be Penalised?

ICO fines are civil monetary penalties issued by the UK's Information Commissioner's Office against organisations that breach the UK GDPR, the Data Protection Act 2018, or the Privacy and Electronic Communications Regulations (PECR). The maximum penalty is £17.5 million or 4% of global annual turnover, whichever is higher.

Any organisation processing UK personal data can be fined, including:

Private companies of any size
Public sector bodies (though the ICO often uses reprimands here)
Charities and not-for-profits
Sole traders and partnerships handling personal data
Overseas organisations targeting UK residents

The ICO considers several factors when calculating fines: the nature and severity of the breach, the number of individuals affected, whether the organisation acted intentionally or negligently, and cooperation during investigation.

The Biggest ICO Fines of 2026

Several enforcement actions in 2026 have set new benchmarks for penalty size and regulatory scope. Below is a summary of the most significant cases, followed by detailed breakdowns.

Comparison Table: Top ICO Fines 2026

Organisation	Sector	Fine	Primary Breach
Advanced Computer Software Group	Healthcare IT	£6.09 million (reduced from £6.09m provisional)	Ransomware & poor access controls
Global Retail Chain (undisclosed)	Retail	£4.7 million	Loyalty data breach
Genomics Testing Firm	Biotech	£3.1 million	Unencrypted DNA data exposure
Political Marketing Agency	Political comms	£1.35 million	Unlawful profiling under PECR
UK Council (Local Authority)	Public sector	£750,000	Freedom of Information data leak
Nuisance Call Firm	Telemarketing	£450,000	Unsolicited PECR calls

1. Advanced Computer Software Group – £6.09 Million

The healthcare software provider was fined after a 2022 ransomware attack impacted NHS 111 services and exposed the personal data of over 79,000 people. The ICO's 2026 final decision cited a failure to implement multi-factor authentication on a customer account used to access the company's systems. Sensitive medical data, including care home records and information about vulnerable people, was compromised. This remains one of the largest fines ever issued to a data processor rather than a data controller.

2. Retail Loyalty Programme Breach – £4.7 Million

A major UK high-street retailer was penalised after a credential-stuffing attack exposed the loyalty accounts of more than 10 million customers. The ICO concluded the retailer failed to detect abnormal login patterns for over six weeks and had no rate-limiting on its authentication endpoints. Customers were exposed to phishing and account takeover risks for months.

3. Genomics Testing Firm – £3.1 Million

A direct-to-consumer DNA testing company suffered a breach exposing genetic profiles and health predisposition data for approximately 155,000 UK customers. The ICO found unencrypted backups stored in a misconfigured cloud bucket. Because genetic data is a special category under Article 9 UK GDPR, the ICO applied a significant multiplier.

4. Political Marketing Agency – £1.35 Million

A political campaign consultancy was fined under PECR for sending over 8 million unsolicited SMS messages during local election campaigns. The agency had purchased marketing lists without proper consent chains and could not evidence lawful basis for processing.

5. Local Council – £750,000

A UK local authority accidentally disclosed personal details of vulnerable residents when responding to a Freedom of Information request. Names, addresses, and safeguarding notes were included in an unredacted spreadsheet. The ICO noted this was the third such incident at the council in four years.

Key Trends in ICO Enforcement for 2026

Looking across the year's penalties, several clear patterns emerge that indicate where the ICO is focusing its regulatory firepower.

Processors Are No Longer Safe

Historically, most ICO fines targeted data controllers. In 2026, the ICO has repeatedly shown that processors—particularly IT service providers, cloud vendors, and SaaS platforms—will be held directly accountable for security failings under Article 32 UK GDPR.

Special Category Data Attracts Higher Penalties

Health, genetic, biometric, and political opinion data continue to attract multipliers of 2x–5x standard fine calculations. Any organisation handling this data should expect enhanced scrutiny.

PECR Enforcement Is Rising Sharply

The ICO issued more PECR penalties in the first three quarters of 2026 than in all of 2024. Nuisance calls, unsolicited SMS, and cookie compliance failures dominate this category.

Public Sector Reprimands Are Escalating to Fines

While the ICO's 2022 policy leaned toward reprimands for public bodies, the volume of repeat incidents has led to renewed use of financial penalties, particularly against councils and NHS trusts with poor track records.

Why UK Businesses Are Being Fined: Common Failures

Reviewing the 2026 penalty decisions reveals a consistent set of root causes. Most fines could have been avoided with foundational controls.

Missing multi-factor authentication on privileged or customer-facing accounts.
Unpatched software, especially internet-facing systems with known CVEs.
Poor access controls, including over-privileged staff and dormant accounts.
Weak incident detection, allowing breaches to persist for weeks or months.
Inadequate consent records for marketing and PECR compliance.
Unencrypted data at rest, particularly in cloud storage and backups.
Insufficient staff training leading to misdirected emails and misconfigured disclosures.

How to Avoid an ICO Fine in 2026 and Beyond

Avoiding an ICO penalty requires a proactive, documented approach to data protection. The regulator repeatedly rewards demonstrable diligence with reduced fines or reprimands instead of penalties.

1. Conduct a Data Protection Impact Assessment (DPIA)

Any high-risk processing—especially involving special category data, large-scale monitoring, or new technology—requires a DPIA. Keep it updated and reviewed annually.

2. Implement Baseline Security Controls

At minimum, deploy MFA on all administrative and customer accounts, patch internet-facing systems within 14 days, encrypt data at rest and in transit, and maintain immutable backups.

3. Audit Your Marketing Consent Chain

If you run email, SMS, or telemarketing campaigns, ensure every contact has a clear, evidenced lawful basis. Document consent timestamps and source, and honour opt-outs within 28 days.

4. Use Secure, Trackable Links

When sharing links in marketing communications, customer emails, or internal documents, use a reputable link management platform that offers HTTPS, access analytics, and the ability to disable compromised links quickly. Tools like Lunyb provide short, secure URLs with click analytics—useful for demonstrating engagement metrics without collecting excessive personal data. For a broader comparison of options, see our Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide.

5. Train Staff Regularly

Human error remains the leading cause of reportable breaches. Quarterly training on phishing, data handling, and subject access requests is now considered baseline by the ICO.

6. Prepare a Breach Response Plan

The 72-hour notification window under UK GDPR is unforgiving. Have a documented plan covering detection, containment, notification to the ICO, and communication with affected data subjects.

What to Do If the ICO Contacts You

An initial ICO enquiry does not automatically mean a fine. Cooperation, transparency, and evidence of remediation heavily influence the final outcome.

Acknowledge promptly and confirm receipt within the timeframe specified.
Engage a qualified DPO or solicitor experienced in UK data protection law.
Preserve all evidence, including logs, emails, and system snapshots.
Provide accurate, complete responses—incomplete disclosures often escalate matters.
Demonstrate remediation with dates, responsible owners, and evidence of new controls.
Consider representations during the Notice of Intent stage; many provisional fines are reduced at this point.

ICO Fines vs Other UK Regulatory Penalties

UK organisations often face overlapping regulatory regimes. Understanding how ICO fines compare helps prioritise compliance investment.

Regulator	Maximum Fine	Focus Area
ICO	£17.5m or 4% turnover	Data protection, PECR
FCA	Unlimited	Financial services conduct
Ofcom	£250,000 or 10% turnover	Broadcasting, telecoms, online safety
CMA	10% global turnover	Competition and consumer protection
HSE	Unlimited	Workplace health and safety

Looking Ahead: What to Expect from ICO Enforcement in 2027

The ICO's published regulatory strategy signals continued focus on several key areas heading into 2027:

AI and automated decision-making — expect the first significant fines under UK GDPR Article 22 for opaque algorithmic profiling.
Children's data — enforcement of the Age Appropriate Design Code will intensify.
Cookie compliance — the ICO has warned it will move from guidance to enforcement against major UK websites still using non-compliant cookie banners.
Data broker transparency — new investigations into adtech and data enrichment providers are already underway.
Cross-border transfers — post-adequacy review, expect scrutiny of international data flows.

Organisations that treat data protection as a strategic function rather than a compliance afterthought will fare best. The ICO has been clear: demonstrable accountability, not perfection, is what reduces regulatory risk.

Frequently Asked Questions

What is the maximum ICO fine in 2026?

The maximum fine under the UK GDPR remains £17.5 million or 4% of global annual turnover, whichever is higher. For PECR breaches, the maximum is £500,000, though the ICO has proposed reforms to align this with UK GDPR levels.

How long does the ICO take to issue a fine?

Investigations typically take 12–24 months from initial notification to final Monetary Penalty Notice. Complex breaches involving multiple jurisdictions can take longer. Organisations receive a Notice of Intent first, allowing 21 days to make representations.

Can small businesses be fined by the ICO?

Yes. While the ICO considers proportionality, small businesses and sole traders have received fines, particularly for PECR breaches such as unsolicited marketing calls. Being small is not a defence against non-compliance.

Do ICO fines go on public record?

Yes. Monetary Penalty Notices are published on the ICO's website, including the organisation name, fine amount, and breach summary. This reputational impact often exceeds the financial cost.

Can I appeal an ICO fine?

Yes. Organisations can appeal to the First-tier Tribunal (General Regulatory Chamber) within 28 days of the Monetary Penalty Notice. Successful appeals are uncommon but do occur, particularly where procedural errors or disproportionate calculations can be demonstrated.

Does using a UK data processor reduce ICO fine risk?

Not automatically. Controllers remain liable for their processors' compliance. However, using processors with robust security certifications (ISO 27001, SOC 2) and clear contractual protections under Article 28 UK GDPR strengthens your accountability position.