ICO Fines 2026: Biggest Data Protection Penalties in the UK

The Information Commissioner's Office (ICO) has continued its enforcement drive into 2026, issuing some of the largest UK data protection penalties since the introduction of the UK GDPR. From healthcare breaches to adtech violations and unsolicited marketing campaigns, this year's fines reveal a regulator that is sharper, faster and more willing to publicly name organisations that mishandle personal data.

This guide breaks down the biggest ICO fines of 2026, explains the legal reasoning behind them, and offers practical guidance for UK businesses, charities and public sector bodies that want to stay on the right side of the law.

What Are ICO Fines?

ICO fines are monetary penalties issued by the UK's data protection regulator against organisations that breach the UK GDPR, the Data Protection Act 2018, or the Privacy and Electronic Communications Regulations (PECR). The ICO can issue fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious infringements.

In 2026, the ICO has shifted its approach in three notable ways:

1. Faster enforcement timelines — investigations that previously took 18–24 months are now closing in under a year.
2. Greater focus on AI and automated decision-making — reflecting the rise of generative AI tools in customer service, recruitment and healthcare.
3. More public sector scrutiny — the ICO has signalled it will no longer rely solely on reprimands for government bodies after years of criticism.

The Biggest ICO Fines of 2026 at a Glance

Below is a summary of the most significant ICO enforcement actions issued in 2026. Figures reflect publicly announced penalties as of the time of writing.

Organisation	Sector	Fine	Primary Breach
Advanced Computer Software Group	Healthcare IT	£6.09m (final)	Inadequate security; NHS ransomware impact
A major UK retailer	Retail	£4.4m	Customer database breach; weak access controls
A national charity	Third sector	£1.35m	Unlawful donor profiling and data sharing
An AI recruitment platform	HR tech	£2.8m	Unlawful automated decision-making
A telecoms marketing firm	Marketing	£500,000	PECR breach: 1.8m unsolicited calls
A London NHS Trust	Public sector	£750,000	Patient record exposure

1. Advanced Computer Software Group — £6.09 Million

The most high-profile fine of 2026 was confirmed against Advanced Computer Software Group, the IT supplier whose 2022 ransomware incident disrupted NHS 111 services and exposed personal data belonging to nearly 80,000 people, including care home residents.

Why the ICO fined them

The ICO concluded that Advanced failed to implement appropriate technical and organisational measures, particularly:

• Lack of multi-factor authentication on a key customer portal
• Inadequate vulnerability scanning
• Gaps in patch management for systems handling special category data

Lessons for IT suppliers

Processors are not invisible to the ICO. If you handle data on behalf of a controller — particularly in healthcare or critical national infrastructure — you carry direct legal responsibility under Article 32 of the UK GDPR.

2. The Retail Breach — £4.4 Million

A well-known UK retailer was fined £4.4 million after a credential-stuffing attack exposed millions of customer records, including hashed passwords, addresses and partial payment data.

Key failures identified

1. No rate limiting on login endpoints
2. Outdated password hashing algorithm
3. Delay of 47 days in notifying the ICO — well past the 72-hour window
4. Inadequate customer communications post-breach

The ICO emphasised that even when an attacker is the proximate cause, controllers remain liable if foreseeable risks were not mitigated.

3. AI Recruitment Platform — £2.8 Million

2026 marked the first major ICO penalty against an AI-driven recruitment platform. The company used algorithmic scoring to rank candidates without meaningful human review, breaching Article 22 of the UK GDPR on automated decision-making.

What went wrong

• Candidates were not informed that an algorithm was making decisive judgments
• No right to obtain human intervention was offered
• The training data contained demographic bias that disadvantaged certain groups
• No Data Protection Impact Assessment (DPIA) was completed before deployment

This case is widely seen as a template for how the ICO will police AI systems going forward, especially as the UK considers its own AI regulatory framework.

4. The Charity Fine — £1.35 Million

A national UK charity was penalised for sharing donor and beneficiary data with commercial partners for wealth screening and lookalike audience targeting — without a valid lawful basis.

The ICO has repeatedly warned charities that the third sector is not exempt from data protection law. Consent must be specific, informed and freely given, and "legitimate interests" cannot be used to justify profiling of vulnerable individuals.

5. PECR Penalties: Unsolicited Calls and Texts

PECR breaches remain the most frequent source of ICO fines. In 2026, the ICO has issued more than £3.5 million in cumulative PECR penalties against marketing firms making unsolicited calls, sending unwanted texts, or ignoring Telephone Preference Service (TPS) registrations.

The biggest PECR fines this year

Company Type	Penalty	Volume of Contacts
Solar panel marketer	£420,000	1.2 million calls
Insurance lead generator	£500,000	1.8 million calls
Debt advice firm	£250,000	540,000 texts
Home improvement firm	£180,000	320,000 calls

Why ICO Fines Are Rising in 2026

Several structural factors explain the surge in enforcement this year:

1. The new Data (Use and Access) Act

The Act, which came into force progressively across 2025–2026, gives the ICO clearer powers, including the ability to compel interviews and impose tighter deadlines for responses to information notices.

2. Increased breach reporting

Mandatory 72-hour breach reporting has matured. Organisations now self-report more incidents, giving the ICO a larger pool of cases to investigate.

3. Public pressure on AI accountability

High-profile failures in automated decision-making — particularly in welfare, healthcare and recruitment — have made the ICO more willing to act swiftly.

4. Cross-border cooperation

The ICO is increasingly coordinating with the EDPB, the Irish DPC and the US FTC, leading to joint investigations and faster intelligence sharing.

How UK Organisations Can Avoid ICO Fines

Compliance is no longer a tick-box exercise. Based on the patterns visible in 2026 enforcement, here are the most effective steps your organisation can take.

1. Conduct realistic risk assessments

DPIAs should be living documents. Update them whenever a system, vendor or processing purpose changes — particularly for AI tools.

2. Strengthen technical controls

• Mandatory multi-factor authentication for all admin accounts
• Modern password hashing (Argon2, bcrypt)
• Network segmentation and least-privilege access
• Regular penetration testing and red-team exercises
• Encrypted DNS and hardened browser configurations for staff handling sensitive data

3. Tighten vendor management

Many of 2026's biggest fines involved third-party processors. Maintain an up-to-date supplier register, conduct due diligence audits, and ensure your data processing agreements reflect current ICO guidance.

4. Train staff continuously

Phishing remains the single most common entry point in reported breaches. Quarterly micro-training sessions outperform annual marathon courses.

5. Be careful with links and shortened URLs

Marketing teams should use trusted, transparent link infrastructure rather than free public shorteners that can be abused for phishing. A privacy-respecting shortener such as Lunyb provides analytics without aggressive third-party tracking, which helps support a defensible lawful basis under UK GDPR. You can read our honest review of Lunyb or compare options in our 2026 buyer's guide if you're evaluating alternatives like those covered in our Rebrandly review.

6. Plan for incidents before they happen

A documented, rehearsed incident response plan can be the difference between a reprimand and a multi-million-pound fine. The ICO routinely cites delayed or chaotic responses as an aggravating factor.

How the ICO Calculates Fines

The ICO follows a structured five-step methodology published in its updated 2024 Penalty Guidance, which continues to apply in 2026:

1. Assess seriousness — nature, gravity and duration of the breach
2. Determine turnover-based starting point — using global annual turnover bands
3. Adjust for aggravating and mitigating factors — cooperation, prior history, remedial action
4. Assess affordability — particularly relevant for charities and SMEs
5. Apply early payment discount — typically 20% if the organisation does not appeal

What Happens After a Fine Is Issued?

Once the ICO issues a Notice of Intent, organisations have 28 days to make written representations. If a final Penalty Notice is issued, payment is typically due within 35 days, with an early-payment discount available. Organisations can appeal to the First-tier Tribunal (General Regulatory Chamber) within 28 days of the final notice.

Several recent fines have been reduced on appeal, but the reputational damage usually persists. The ICO's enforcement page is widely monitored by journalists, competitors and customers.

The Outlook for the Rest of 2026 and Beyond

Expect the ICO to continue focusing on:

• Generative AI in customer service, hiring and healthcare
• Children's data, especially in education tech and gaming
• Adtech and real-time bidding
• Public sector accountability, particularly the NHS and local authorities
• Cookie compliance, following the rollout of automated cookie audit tools

Organisations that treat data protection as a strategic priority — rather than a compliance afterthought — will be best positioned to navigate the rest of the year without ending up on the ICO's enforcement page.

FAQ

What is the maximum ICO fine in 2026?

For the most serious breaches of the UK GDPR, the ICO can issue fines of up to £17.5 million or 4% of an organisation's global annual turnover, whichever is higher. For PECR breaches, the cap remains £500,000 per infringement.

Has the ICO issued any fines against public sector bodies in 2026?

Yes. After years of relying on reprimands, the ICO has resumed issuing monetary penalties to public sector bodies, including NHS Trusts and local authorities. This reflects the conclusion of the two-year trial public sector approach and continued criticism that reprimands lacked deterrent effect.

How long does an ICO investigation take?

In 2026, most investigations close within 9–14 months, down from the historical average of 18–24 months. Complex cases involving multiple jurisdictions or AI systems can still take longer.

Can a small business be fined by the ICO?

Yes. While the ICO considers affordability when setting fines, small businesses and sole traders have been penalised — particularly for PECR breaches involving nuisance calls or texts. SMEs should not assume they are below the regulator's radar.

Does paying the fine end the matter?

Not necessarily. Affected individuals retain the right to bring civil claims for compensation under Article 82 of the UK GDPR, and class-action style group litigation has become more common. Reputational and contractual consequences can also outlast the financial penalty.