ICO Fines 2026: Biggest Data Protection Penalties in the UK

The Information Commissioner's Office (ICO) has continued to sharpen its enforcement teeth in 2026, issuing some of the largest data protection penalties the UK has seen since the introduction of the UK GDPR. From nuisance marketing calls to catastrophic ransomware breaches, the regulator has made it clear that organisations mishandling personal data will pay a significant price.

This guide breaks down the biggest ICO fines of 2026, explains the legal reasoning behind each penalty, and offers practical steps your organisation can take to stay compliant.

What Are ICO Fines?

ICO fines are monetary penalties issued by the UK's Information Commissioner's Office to organisations that breach the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, or the Privacy and Electronic Communications Regulations (PECR). The maximum penalty under UK GDPR is £17.5 million or 4% of global annual turnover, whichever is higher.

These fines are not merely symbolic. They are designed to be dissuasive, proportionate, and effective, encouraging a culture of accountability across every sector that processes personal data.

Types of Breaches That Trigger Fines

• Security failures — inadequate technical or organisational measures leading to breaches.
• Unlawful marketing — unsolicited calls, texts, or emails without valid consent.
• Failure to report — not notifying the ICO within 72 hours of a qualifying breach.
• Excessive data collection — processing more personal data than necessary.
• Lack of lawful basis — processing data without consent, contract, or legitimate interest.

The Biggest ICO Fines of 2026

The following table summarises the most significant ICO enforcement actions of 2026, ranked by penalty value. Each case is examined in more detail in the sections below.

Organisation	Sector	Fine (£)	Primary Breach
Advanced Computer Software Group	Healthcare IT	£6.09 million	Ransomware — inadequate security
Genomics Health Provider (anonymised)	Healthcare	£3.2 million	Data leak of sensitive category data
Major UK Retail Chain	Retail	£2.8 million	Loyalty scheme data misuse
FinTech Lending Platform	Financial services	£1.95 million	Credit reference data breach
National Marketing Agency	Marketing	£1.5 million	PECR violation — 10m unlawful texts
Local Authority (London)	Public sector	£750,000	Housing records exposure

1. Healthcare IT Supplier — £6.09 million

The largest fine of the year targeted a major healthcare IT supplier whose systems support NHS 111 and thousands of GP practices. A ransomware attack in 2022 exposed personal data belonging to nearly 80,000 people, including some information relating to how carers accessed medication for those receiving home care.

The ICO concluded that the organisation had failed to implement appropriate technical measures — notably multi-factor authentication on all systems containing personal data. This case set a precedent for holding data processors, not just controllers, directly accountable under Article 32 of the UK GDPR.

2. Genomics Health Provider — £3.2 million

A private genomics testing company was penalised after a misconfigured cloud storage bucket exposed genetic test results and identifiable customer records for over 14 months. Because genetic data is classified as "special category data" under Article 9 of UK GDPR, the ICO applied an elevated multiplier.

Key regulatory takeaway: sensitive data attracts sensitive scrutiny. Encryption at rest and quarterly configuration audits are now baseline expectations.

3. Major UK Retail Chain — £2.8 million

A well-known retail chain was fined for repurposing loyalty scheme data for behavioural advertising without refreshing customer consent. The ICO found the retailer had relied on outdated privacy notices from 2019 that predated significant changes in how the data was used.

This case reinforced the ICO's position that consent is not "set and forget" — material changes to processing must trigger renewed transparency and, where appropriate, fresh consent.

4. FinTech Lending Platform — £1.95 million

A digital lending platform suffered a credential-stuffing attack that exposed credit reference data for approximately 45,000 applicants. The ICO's investigation revealed the platform lacked rate limiting, bot detection, and had not enforced password rotation for staff accounts with elevated privileges.

5. National Marketing Agency — £1.5 million (PECR)

Under PECR, a marketing agency sent more than 10 million unsolicited text messages promoting debt-help services. Consent records were either fabricated or sourced from unrelated third-party data brokers. This is one of the largest PECR fines in ICO history and signals a hardening stance on "lead generation" abuses.

6. London Local Authority — £750,000

A London borough council exposed housing records — including details about domestic abuse survivors — through an unsecured online portal. The ICO reduced the fine substantially in recognition of public-sector budget constraints, but the reputational damage was considerable.

Trends in ICO Enforcement for 2026

Reviewing 2026's enforcement docket reveals five clear patterns shaping the regulatory landscape.

1. Processor accountability — Suppliers and IT partners are increasingly named alongside controllers.
2. Ransomware focus — Failing to implement MFA, patching, and network segmentation is now treated as gross negligence.
3. Special category data — Health, biometric, and genetic data attract higher multipliers.
4. AI and profiling — The ICO issued its first formal guidance updates on generative AI training data, with warning notices to two adtech firms.
5. Public sector leniency ending — While reprimands remain common, monetary penalties for councils and NHS trusts are returning.

How ICO Fines Are Calculated

The ICO's data protection fining guidance, updated in 2024 and refined again in 2025, uses a five-step methodology:

1. Assess seriousness — nature, gravity, and duration of the infringement.
2. Determine turnover — for undertakings, the fine ceiling scales with global turnover.
3. Calculate starting point — a percentage of turnover based on seriousness band.
4. Adjust for aggravating/mitigating factors — cooperation, previous breaches, remediation efforts.
5. Ensure effectiveness, proportionality, and dissuasiveness — the final check.

Aggravating Factors

• Repeated breaches or prior warnings ignored
• Intentional or reckless conduct
• Failure to cooperate with the investigation
• Financial benefit derived from the breach

Mitigating Factors

• Prompt breach notification (within 72 hours)
• Voluntary remediation and victim notification
• Evidence of robust prior compliance programmes
• Full cooperation with the ICO

Lessons for UK Businesses in 2026

The 2026 enforcement pattern makes it clear that data protection is a board-level responsibility. Below are the practical steps organisations should prioritise this year.

1. Audit Your Data Processors

If a supplier holds personal data on your behalf, your Article 28 contracts must be current, and your due diligence must be documented. Ask for evidence of ISO 27001, SOC 2, or Cyber Essentials Plus certification.

2. Enforce Multi-Factor Authentication Everywhere

The Advanced Computer Software fine confirmed that MFA is no longer optional. Every account with access to personal data — especially administrative accounts — must use phishing-resistant authentication.

3. Review Consent and Privacy Notices Annually

The retail loyalty case shows that consent goes stale. Schedule an annual privacy notice review and re-consent campaign whenever processing purposes materially change.

4. Encrypt Sensitive Links and Data in Transit

Personal data shared via URLs — password resets, invoice access, health portals — should never be exposed through public shortening services that lack access controls. Tools like Lunyb offer privacy-respecting link management with click analytics that don't compromise user data. For a broader comparison of what to look for, see our 2026 URL shortener buyer's guide.

5. Practice Breach Response

Run tabletop exercises twice a year. Your Data Protection Officer, IT lead, communications team, and legal counsel should all know their roles when the 72-hour clock starts ticking.

Sector-by-Sector Impact

Sector	Total 2026 Fines	Primary Risk Area
Healthcare	£10.2m	Ransomware, special category data
Financial services	£4.1m	Credential attacks, subject access failures
Retail & e-commerce	£3.6m	Consent, adtech, loyalty schemes
Marketing & PECR	£3.1m	Unsolicited calls and texts
Public sector	£1.4m	Records exposure, misdirected emails

What to Expect for the Rest of 2026 and Into 2027

The ICO has signalled three enforcement priorities for the remainder of the year:

1. Children's data — expect further action under the Age Appropriate Design Code, particularly around social platforms and gaming.
2. Generative AI — training data provenance and transparency will drive new investigations.
3. Data brokers — the ICO is finalising a market-wide review of the adtech ecosystem, with enforcement expected in Q4.

Organisations that treat compliance as an annual tick-box exercise will find themselves increasingly exposed. The regulator's 2026 track record shows a willingness to issue headline-grabbing penalties when the evidence justifies it.

Frequently Asked Questions

What is the maximum ICO fine in 2026?

The maximum penalty under UK GDPR remains £17.5 million or 4% of global annual turnover, whichever is higher. For PECR breaches, the maximum is £500,000, though PECR reform proposals may raise this ceiling in 2027.

How long does the ICO take to issue a fine?

Investigations typically take 12 to 24 months from the point of a reported breach. Complex cases involving international data transfers or multiple processors can take considerably longer. Organisations receive a Notice of Intent before any final penalty is imposed and have 28 days to make representations.

Can I appeal an ICO fine?

Yes. Appeals are made to the First-tier Tribunal (Information Rights), which can uphold, reduce, or overturn the penalty. Several high-profile fines in recent years have been reduced significantly on appeal, so specialist legal advice is essential.

Do ICO fines apply to small businesses?

Yes, but the ICO's fining guidance requires penalties to be proportionate to turnover. Small businesses more commonly receive reprimands, enforcement notices, or modest fines. However, egregious breaches — such as deliberate PECR violations — can still trigger substantial penalties regardless of size.

What is the difference between an ICO fine and a reprimand?

A reprimand is a formal statement that an organisation has breached data protection law but does not carry a monetary penalty. Reprimands are increasingly used for public sector bodies and first-time offenders demonstrating good faith remediation. Fines are reserved for more serious or repeated failures.

How can I report a data breach to the ICO?

Qualifying personal data breaches must be reported within 72 hours of discovery through the ICO's online reporting portal. You will need to describe the nature of the breach, categories and approximate numbers of data subjects affected, likely consequences, and measures taken to mitigate harm.