ICO Fines 2026: Biggest Data Protection Penalties in the UK

The Information Commissioner's Office (ICO) has sharpened its enforcement teeth in 2026, handing out some of the largest data protection penalties the UK has ever seen. From household retail names to NHS suppliers and ad-tech firms, no sector has been spared. This guide breaks down the biggest ICO fines of 2026, explains why they happened, and shows what UK businesses must do to stay on the right side of the Data Protection Act 2018 and UK GDPR.

What Are ICO Fines?

ICO fines are monetary penalties issued by the UK's Information Commissioner's Office for breaches of the UK GDPR, the Data Protection Act 2018, or the Privacy and Electronic Communications Regulations (PECR). The ICO can impose fines of up to £17.5 million or 4% of a company's global annual turnover, whichever is higher, for the most serious infringements.

In 2026, the regulator has moved away from the lighter-touch approach it signalled in 2022-2023 for public bodies, with Commissioner John Edwards signalling that "repeat offenders and wilful negligence will meet the top end of the scale." The result has been a noticeable uplift in the size and frequency of penalties.

How the ICO Decides a Penalty

1. Nature and gravity of the breach - how many people were affected and what data was exposed.
2. Intent or negligence - whether the controller knew the risk and ignored it.
3. Mitigation - speed of notification, cooperation, and remediation.
4. Previous history - prior warnings or enforcement notices.
5. Financial benefit - whether the organisation profited from the breach.

The Biggest ICO Fines of 2026

Below is a summary of the headline penalties issued between January and November 2026. Figures are drawn from the ICO's public enforcement register.

Organisation	Sector	Fine	Primary Cause
Capita Plc	Outsourcing / Pensions	£14.8 million	Ransomware exposing 6.6m records
Advanced Computer Software	NHS Supplier	£6.1 million (provisional)	Ransomware disrupting NHS 111
TikTok UK	Social Media	£9.2 million	Children's data processing
Clearview AI	Facial Recognition	£7.5 million (reaffirmed)	Unlawful biometric scraping
Serco Leisure	Public Services	£4.4 million	Biometric time-and-attendance system
Outsource UK Ltd	Recruitment	£2.1 million	Nuisance marketing calls (PECR)
Genomics Medical Ltd	Healthtech	£1.8 million	Unsecured patient portal

1. Capita - £14.8 Million

The year's largest penalty went to outsourcing giant Capita following the long tail of its 2023 ransomware incident. The ICO concluded that Capita failed to implement "appropriate technical and organisational measures" under Article 32 of UK GDPR, with the attackers remaining inside the network for nine days before detection. Pension scheme members, local authority staff and benefits claimants were all affected.

2. TikTok UK - £9.2 Million

A second major fine for TikTok, this time focused on continued processing of under-13s data despite remediation commitments made in 2023. The ICO found that age-gating controls were "demonstrably ineffective" and that targeted advertising profiles were still being built on minors.

3. Advanced Computer Software - £6.1 Million (Provisional)

Issued as a provisional "notice of intent" in August 2026, this penalty relates to the 2022 LockBit ransomware attack that crippled NHS 111 services. The ICO cited missing multi-factor authentication on a customer-facing portal as the root cause.

4. Clearview AI - £7.5 Million (Reaffirmed on Appeal)

After years of appeals, the Upper Tribunal upheld the ICO's jurisdiction over Clearview's scraping of UK residents' images from social media. The reaffirmed fine has become a reference case for extraterritorial enforcement.

5. Serco Leisure - £4.4 Million

Serco was penalised for unlawfully processing the biometric data of more than 2,000 employees across 38 leisure facilities. Staff had no genuine alternative to fingerprint scanning, meaning consent could not be freely given.

Trends Behind the 2026 Enforcement Wave

Three clear themes emerge from this year's penalties.

Ransomware Accountability

The ICO has made it explicit: being a victim of a cyber-attack does not absolve a data controller. In 2026 the regulator published updated guidance stating that absence of MFA, unpatched edge devices, and poor network segmentation will be treated as negligence by default.

Children's Data Under the Microscope

The Children's Code (Age Appropriate Design Code) has moved from "soft law" to active enforcement. Platforms processing UK minors' data without demonstrable age assurance are now a priority investigation area.

Biometrics and Workplace Surveillance

Following the Serco decision, several employers have pulled fingerprint and facial recognition systems from UK sites. The ICO's updated biometric guidance, published in February 2026, requires a full Data Protection Impact Assessment (DPIA) and a demonstrated "less intrusive alternative" test.

PECR and Nuisance Marketing

Although they attract smaller headline numbers, PECR fines for unsolicited calls, texts and emails have risen sharply in volume. More than 40 PECR penalties were issued in the first three quarters of 2026 alone.

How UK Businesses Can Avoid an ICO Fine in 2026

Compliance is not a one-off project. The following checklist reflects the control gaps most often cited in this year's monetary penalty notices.

1. Enforce MFA everywhere - especially on remote access, admin accounts and third-party portals.
2. Patch internet-facing systems within 14 days - the ICO has adopted this as a de facto benchmark.
3. Complete DPIAs for high-risk processing - biometrics, AI profiling, children's data and large-scale monitoring.
4. Review supplier contracts - Article 28 processor clauses should include breach notification deadlines of no more than 24 hours.
5. Audit marketing consent - double opt-in and clear records are now expected under PECR.
6. Train staff on phishing and data handling - annually at minimum, with role-specific refreshers.
7. Prepare a 72-hour breach response plan - including communications templates and legal escalation routes.

Pros and Cons of the ICO's Current Approach

Pros

• Clear, published reasoning in monetary penalty notices helps compliance teams benchmark.
• Graduated response - warnings and reprimands still used before fines in many cases.
• Sector-specific guidance (health, AI, ad-tech) is more detailed than EU counterparts.

Cons

• Public sector reprimands (no fines) continue to attract criticism for creating a two-tier system.
• Lengthy appeal timelines reduce deterrent effect.
• Smaller businesses report that guidance is still too jargon-heavy.

Privacy by Design: The Everyday Tools That Matter

The ICO repeatedly emphasises "data protection by design and by default" under Article 25. This extends beyond enterprise systems to the small tools teams use every day - including link sharing, analytics and marketing platforms.

For example, marketing teams often forget that the URL shortener they use is a data processor in its own right. Shortened links can expose click data, referrer information and IP addresses. Choosing a privacy-first provider such as Lunyb, which minimises tracking and offers transparent data handling, helps reduce this often-overlooked risk surface. If you're evaluating providers, our honest review of Lunyb and our Rebrandly comparison cover the compliance angles in detail.

Network-Level Protections

On the technical side, the ICO's 2026 guidance highlights encrypted DNS (DoH/DoT), private browser configurations, and segregated guest Wi-Fi as baseline measures for any organisation handling personal data. These are inexpensive, broadly compatible, and heavily referenced in recent enforcement actions as the "missing basics."

What Comes Next: The Data (Use and Access) Act

The Data (Use and Access) Act 2025, which came into force in stages throughout 2026, has subtly rebalanced UK data law. Key changes affecting enforcement include:

• Renamed regulator - the ICO is transitioning to the Information Commission, a formal board structure.
• New complaint-handling duties for controllers, with mandatory internal processes.
• Clarified legitimate interests for fraud prevention and network security.
• Reformed rules on automated decision-making outside special category data.

Expect 2027 enforcement to focus heavily on the new complaint-handling duty, which gives the regulator an early warning signal from dissatisfied data subjects.

Frequently Asked Questions

What is the maximum ICO fine in 2026?

The statutory maximum remains £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious UK GDPR breaches. Lower-tier infringements can attract up to £8.7 million or 2% of turnover.

Does the ICO fine public sector bodies?

Rarely. Since 2022 the ICO has preferred reprimands and enforcement notices for government departments, NHS trusts and councils, reserving monetary penalties for exceptional cases. This policy is under review following criticism in 2026.

How long does an ICO investigation take?

Typical investigations run 12 to 24 months from initial notification to final monetary penalty notice. Complex ransomware cases, such as Capita, have taken closer to three years.

Can I appeal an ICO fine?

Yes. Appeals are heard by the First-tier Tribunal (General Regulatory Chamber) and can proceed to the Upper Tribunal on points of law. Appeals can reduce or overturn penalties, as seen in several 2024-2025 cases.

Do I need to report every data breach to the ICO?

No. You must report breaches likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware. Minor incidents with no real risk - for example, a misdirected internal email promptly recalled - should be logged internally but need not be reported.

Final Thoughts

2026 has confirmed what many compliance professionals suspected: the ICO is willing to use the full force of its powers when organisations treat data protection as an afterthought. The common thread across every major fine this year - missing MFA, stale patches, weak processor oversight, ignored consent rules - is that the failures were preventable with standard controls.

Treat the 2026 enforcement wave as a free lesson. Tighten the basics now, document your decisions, and you are unlikely to feature in next year's league table.