The UK enforcement register
What data failures actually cost
Every enforcement action the Information Commissioner's Office has published — 217 of them — turned into structured records you can search, filter and total. The ICO publishes all of this. Nobody has made it queryable.
217
actions on record
£53.48m
total penalties
43
actions carrying a fine
£14.47m
largest single penalty
- Geoffrey Smith A council worker who unlawfully accessed hundreds of personal records has been handed a suspended sentence.
- Debbie Okparavero and Maliha Islam Confiscation orders totalling over £118,000 have been secured against two former RAC employees who unlawfully copied and sold personal infor…
- Thermotech Wall and Loft Surveys Ltd In April 2025, the ICO carried out a search warrant to obtain evidence in relation to TWLS and its compliance with PECR. Following an extens…
- Thermotech Wall and Loft Surveys Ltd In April 2025, the ICO carried out a search warrant to obtain evidence in relation to TWLS and its compliance with PECR. Following an extens…
- KRA Consultancy Ltd KRA Consultancy Ltd was fined £300,000 for sending over 5.5 million unsolicited direct marketing and fake bailiff texts in breach of regulat…
- KRA Consultancy Ltd KRA Consultancy Ltd was issued with an enforcement notice for sending over 5.5 million unsolicited direct marketing and fake bailiff texts i…
- Rizwan Manjra We have secured a £355,000 confiscation order against former Manchester motor insurance worker who was previously found guilty of unauthoris…
- South Staffordshire Plc and South Staffordshire Water Plc The Information Commissioner’s Office (ICO) has imposed a fine of £963,900 on South Staffordshire Plc & South Staffordshire Water Plc for th…
- SA Assistance Ltd Contravention of Regulation 21A and 24 of the PECR. SA Assistance Ltd instigated calls to individuals about claims management services witho…
- Energy Prices Direct Limited Contravention of Regulations 21 and 24 of the PECR. Energy Prices Direct Limited offer energy switching services. Information demonstrated t…
- Jacksons Marketing Ltd Jacksons Marketing Ltd was fined £130,000 for making 232,776 unsolicited live direct marketing calls between 29 January 2024 and 12 December…
- Jacksons Marketing Ltd Jacksons Marketing Ltd was fined £130,000 for making 232,776 unsolicited live direct marketing calls between 29 January 2024 and 12 December…
- Reddit, Inc. We imposed a £14,472,500.00 penalty to Reddit, Inc. for infringing Articles 5(1)(a), 6, and 8, and Article 35 of the UK GDPR.
- The Commissioner of Police for the City of London A reprimand has been issued to The Commissioner of Police for the City of London (COLP), after it failed to meet its data protection obligat…
- Christopher Munro and William Chipoma Two further people have been convicted following our extensive investigation into the unlawful accessing and sale of personal information ob…
- MediaLab.AI, Inc. £247,590 penalty imposed on MediaLab.AI, Inc. in respect of infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR. MediaLab operated the Im…
- TMAC Ltd TMAC contravened regulations 21 and 24 of PECR and the ICO issued a monetary penalty of £100,000 and an enforcement notice. Between 8 Febr…
- TMAC Ltd TMAC contravened regulations 21 and 24 of PECR and the ICO issued a monetary penalty of £100,000 and an enforcement notice. Between 8 Febr…
- Allay Claims Ltd MPN and EN issued to Allay Claims Ltd due to a large volume of unsolicited SMS being sent, promoting PPI tax refund services
- Allay Claims Ltd MPN and EN issued to Allay Claims Ltd due to a large volume of unsolicited SMS being sent, promoting PPI tax refund services
- Staines Health Group Reprimand Issued - Staines Health Group sent excessive medical details about a terminally ill patient to their insurance company. The patien…
- Police Service of Scotland The Information Commissioner's Office (ICO) has fined the Police Service of Scotland £66,000 and issued a Reprimand for serious failures in …
- ZMLUK Limited ZMLUK Limited were issued with an MPN due to sending unsolicited emails promoting energy saving products.
- Post Office Limited On 25 April 2024, Post Office Limited (POL) uploaded an unredacted copy of a legal Settlement Deed to its corporate website instead of the i…
- LastPass UK Ltd £1,228,283 penalty issued to password management provider LastPass UK Ltd on 20 November 2025 in respect of infringements of Article 5(1)(f)…
- Lead Pronto Ltd Lead Pronto Ltd were issued with an MPN and an EN due to sending unsolicited SMS promoting Government funded boiler grants.
- Lead Pronto Ltd Lead Pronto Ltd were issued with an MPN and an EN due to sending unsolicited SMS promoting Government funded boiler grants.
- Capita plc and Capita Pension Solutions Ltd The Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m following a cyber attack in Apri…
- South Wales Police We issued an enforcement notice to South Wales Police (SWP) over serious delays in handling subject access requests (SARs). Our investigatio…
- Qonain Hussain A former insurance claims advisor has been sentenced for unlawfully accessing personal injury claim records.
- Bharat Singh Chand Bharat Singh Chand is a self-employed lead generator. Between 3 December 2023 and 3 July 2024, he sent or instigated the sending of 966,449 …
- Bharat Singh Chand Bharat Singh Chand is a self-employed lead generator. Between 3 December 2023 and 3 July 2024, he sent or instigated the sending of 966,449 …
- Jason Blake The director of a care home in Bridlington, Yorkshire, has been fined for refusing to respond to a request for a resident’s personal informa…
- Green Spark Energy Ltd Green Spark Energy Ltd (GSE) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends…
- Green Spark Energy Ltd Green Spark Energy Ltd (GSE) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends…
- Home Improvement Marketing Ltd Home Improvement Marketing Ltd (HIML) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complai…
- Home Improvement Marketing Ltd Home Improvement Marketing Ltd (HIML) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complai…
- Bristol City Council The Information Commissioner’s Office (ICO) has issued an enforcement notice to Bristol City Council (BCC) for failing to comply with its le…
- Birthlink The Information Commissioner’s Office (ICO) has fined Scottish charity Birthlink £18,000 after it destroyed approximately 4,800 personal rec…
- South Yorkshire Police A reprimand has been issued to South Yorkshire Police for failing to ensure it had appropriate technical security and organisation measures …
- 23andMe The Information Commissioner has fined 23andMe, Inc £2,310,000 for infringements of Articles 5(1)(f) and 32(1) of the UK GDPR between 25 May…
- London Borough of Hammersmith and Fulham We issued a reprimand to the London Borough of Hammersmith and Fulham after hidden data within a spreadsheet was inadvertently disclosed in …
- Greater Manchester Police Due to historic outstanding requests Chief Constable Greater Manchester Police had continually failed to meet its data protection obligation…
- Darian Bishop trading as ECO4U Between 9 January 2023 to 9 October 2023, there were 194,110 unsolicited direct marketing calls made to subscribers who were registered with…
- Darian Bishop trading as ECO4U Between 9 January 2023 to 9 October 2023, there were 194,110 unsolicited direct marketing calls made to subscribers who were registered with…
- DPP Law Ltd The Information Commissioner has fined law firm DPP Law Ltd £60,000 for its infringements of Articles 5(1)(f), 32(1), 32(2) and 33(1) of the…
- AFK Letters Co Ltd It was found that between January and September 2023, AFK made 95,277 spam calls resulting in several complaints being made to the ICO and T…
- AFK Letters Co Ltd It was found that between January and September 2023, AFK made 95,277 spam calls resulting in several complaints being made to the ICO and T…
- Advanced Computer Software Group Limited The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (Advanced) £3.07m for security failings that put …
- Greater Manchester Police We issued a reprimand to Greater Manchester Police for failing to ensure that appropriate technical or organisational measures were in place…
- Smart Home Ensured Limited Between 4 July 2023 to 24 August 2023 Smart Home Ensured Limited made 14,508 unsolicited calls for direct marketing purposes in breach of Re…
- Glasgow City Council A reprimand was issued to Glasgow City Council as during the period between 01 April 2023 to 01 March 2024, they responded to 45% of incomin…
- City of Edinburgh Council A reprimand was issued to City of Edinburgh Council as during the period between 01 January 2023 to 31 December 2023, it had failed to respo…
- United Lincolnshire Teaching Hospitals NHS Trust A reprimand was issued to United Lincolnshire Teaching Hospitals NHS Trust as during the period between 01 March 2021 to 31 March 2022, it h…
- Money Bubble Ltd EN It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to…
- Money Bubble Ltd MPN It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to…
- Breathe Services Ltd Breathe Services Ltd (BSL), a debt advice company based in Bolton, first came to the attention of the ICO as part of a wider investigation i…
- Breathe Services Ltd Breathe Services Ltd (BSL), a debt advice company based in Bolton, first came to the attention of the ICO as part of a wider investigation i…
- ESL Consultancy Services Ltd Between 15 September 2022 and 5 December 2023, a total of 37,977 complaints were received regarding direct marketing messages which were sen…
- ESL Consultancy Services Ltd Between 15 September 2022 and 5 December 2023, a total of 37,977 complaints were received regarding direct marketing messages which were sen…
- Quick Tax Claims Limited An ICO investigation revealed that Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting …
- Quick Tax Claims Limited An ICO investigation revealed that Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting …
- National Debt Advice Limited National Debt Advice sent 129,902 unsolicited direct marketing text messages to individuals in breach of regulation 22 of PECR resulting in …
- National Debt Advice Limited National Debt Advice sent 129,902 unsolicited direct marketing text messages to individuals in breach of regulation 22 of PECR resulting in …
- Southend-on-Sea City Council We issued a reprimand to Southend-on-Sea City Council in Essex after hidden data on a spreadsheet released as part of a freedom of informati…
- WerepairUK Ltd WerepairUK Ltd made 42,688 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £80,000 and issued …
- WerepairUK Ltd WerepairUK Ltd made 42,688 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £80,000 and issued …
- Service Box Group Limited Service Box Group Limited made 5,361 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £40,000 a…
- Service Box Group Limited Service Box Group Limited made 5,361 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £40,000 a…
- Police Service of Northern Ireland The Police Service of Northern Ireland has been fined £750,000 for infringing Articles 5(1)(f), 32(1) and (2) of the UK GDPR between 25 May …
- Bonne Terre Limited t/a Sky Betting and Gaming We issued a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing people’s data through advertising…
- The Labour Party The Labour Party were issued with a reprimand for failing to respond to people’s request for their own personal data, also know as a subject…
- Coastal Windows & Conservatories (UK) Limited Coastal Windows & Conservatories Limited made over 18,000 unsolicited marketing calls between 1 January and 1 June 2023 to numbers registere…
- Coastal Windows & Conservatories (UK) Limited Coastal Windows & Conservatories Limited made over 18,000 unsolicited marketing calls between 1 January and 1 June 2023 to numbers registere…
- Chelmer Valley High School Chelmer Valley High School have been issued a reprimand in respect of Article 35(1). The school failed to complete a Data Protection Impact …
- London Borough of Hackney The Information Commissioner’s Office has issued the London Borough of Hackey with a reprimand following a cyber-attack in 2020 that led to …
- Levales Solicitors LLP Reprimand issued to Levales Solicitors LLP (‘Levales’) in respect of Articles 32(1)(b) and 32(1)(d). A threat actor accessed Levales’ cloud-…
- The Electoral Commission Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a thre…
- Clyde Valley Housing Association Clyde Valley Housing Association have received the following reprimand because of an infringement that occurred in July 2022 when they relea…
- University Hospital of Southampton NHS Foundation Trust A reprimand is being issued to University Hospital of Southampton NHS Foundation Trust as they have only responded to 59% of incoming SARs w…
- Home Office An enforcement notice and a warning have been issued to the Home Office for failing to assess the privacy risks posed by the electronic moni…
- Birmingham Children's Trust Community Interest Company Reprimand issued to Birmingham Children’s Trust Community Interest company in respect of Article 5(1)(f) and 32(1)(b) and 2. A child protect…
- Dover Harbour Board A reprimand is being issued to Dover Harbour Board in respect of the creation and use of a social media distribution group, initially create…
- Chief Constable of Kent Police A reprimand is being issued to Kent Police in respect of an incident in February 2021 when a Kent Police officer took a photograph of an ind…
- Mayor’s Office for Policing and Crime (MOPAC) Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 N…
- Pinnacle Life Limited Between 5 May 2021 to 5 May 2022, there were 47,998 connected calls unsolicited direct marketing calls being made to subscribers who were re…
- Pinnacle Life Limited Between 5 May 2021 to 5 May 2022, there were 47,998 connected calls unsolicited direct marketing calls being made to subscribers who were re…
- The Central Young Men’s Christian Association The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealin…
- The Central Young Men’s Christian Association The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealin…
- Penny Appeal The Information Commissioner’s Office (ICO) has issued an Enforcement Notice to Penny Appeal, for sending 461,650 spam text messages over a …
- Chief Constable West Midlands Police A reprimand has been issued to West Midlands Police after the force repeatedly incorrectly linked and merged the records of two individuals …
- Ministry of Defence The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of G…
- Serco Leisure Operating Limited and relevant associated Trusts Serco Leisure, Serco Jersey and seven associated community leisure trusts have been issued enforcement notices ordering them to stop using f…
- Dr Telemarketing Between 11 February 2021 to 24 January 2022, there were 80,240 connected calls unsolicited direct marketing calls being made to subscribers …
- Dr Telemarketing Between 11 February 2021 to 24 January 2022, there were 80,240 connected calls unsolicited direct marketing calls being made to subscribers …
- Chief Constable Devon and Cornwall Police Chief Constable Devon and Cornwall Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the …
- Chief Constable Dorset Police Chief Constable Dorset Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for…
- L.A.D.H Limited L.A.D.H Limited sent 31,329 direct market text messages to individuals in breach of regulation 22 and 23 of PECR. The company was fined £50,…
- L.A.D.H Limited L.A.D.H Limited sent 31,329 direct market text messages to individuals in breach of regulation 22 and 23 of PECR. The company was fined £50,…
- Crown Prosecution Service An Enforcement Notice has been issued to the Crown Prosecution Service in relation to a contravention of the sixth data protection principle…
- Poxell Ltd Poxell first came to the attention of the Commissioner in April 2022 as part of an investigation formed to assess and analyse complaint tren…
- Poxell Ltd Poxell first came to the attention of the Commissioner in April 2022 as part of an investigation formed to assess and analyse complaint tren…
- Skean Homes Ltd Skean first came to the attention of the Commissioner in 2022 as part of an operation formed to assess and analyse complaint trends in relat…
- Skean Homes Ltd Skean first came to the attention of the Commissioner in 2022 as part of an operation formed to assess and analyse complaint trends in relat…
- Grocery Delivery E-Services UK Ltd t/a HelloFresh The Information Commissioner’s Office (ICO) has fined food delivery company HelloFresh £140,000 for a campaign of 79 million spam emails and…
- South Tees Hospitals NHS Trust The reprimand was issued as the South Tees Hospitals NHS Trust (the Trust) was found to have not ensured that its staff were fully trained a…
- Finham Park Multi Academy Trust Finham Park Multi Academy Trust have been issued a Reprimand in respect of Articles 5 (1) (f) and 32 (1) (b). An unauthorised third party ut…
- Daniel George Bentley and Taipan Trading Ltd Daniel George Bentley is a sole trader and director of Taipan Trading Ltd. Between 1 May 2022 and 31 July 2023 he and his company sent over …
- Bank of Ireland BOI failed to ensure the accuracy of customers’ default loan status which led to inaccurate personal data being held on their account which …
- Charnwood Borough Council Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abus…
- NHS Fife The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Fife, after an unauthorised individual was able to enter a ward an…
- Intelling Ltd Between 1 January 2021 and 11 November 2021, Intelling sent 1,164,877 direct marketing messages in breach of Reg 22 of PECR. Intelling f…
- GRS (Roadstone) Limited The Information Commissioner (the Commissioner) issues a reprimand to GRS (Roadstone) Limited in respect of infringements of Article 32 (1) …
- Complete Marketing Services Ltd Between 8 June 2021 and 4 February 2022, CMS instigated 242,497 unsolicited direct marketing calls in breach of Reg 21 and 24 of PECR. C…
- Complete Marketing Services Ltd Between 8 June 2021 and 4 February 2022, CMS instigated 242,497 unsolicited direct marketing calls in breach of Reg 21 and 24 of PECR. C…
- DPG Professional Services Ltd Between 3 August 2021 and 3 August 2022, DPG made 74,119 unsolicited calls for direct marketing purposes in breach of Reg 21 of PECR resulti…
- DPG Professional Services Ltd Between 3 August 2021 and 3 August 2022, DPG made 74,119 unsolicited calls for direct marketing purposes in breach of Reg 21 of PECR resulti…
- University Hospital of Derby and Burton NHS Trust (UHDB) UHDB failed to have adequate processes in place, especially when processing special category data, which resulted in referrals for out-patie…
- Police Service of Northern Ireland (PSNI) PSNI failed to have appropriate measures in place to prevent unlawful sharing of personal data including criminal data with the United State…
- Argentum Data Solutions Ltd Between 1 January 2021 and 31 January 2022 there were a total of 2,330,423 SMS sent without consent. 24,309 were sent by ADS directly and it…
- Argentum Data Solutions Ltd Between 1 January 2021 and 31 January 2022 there were a total of 2,330,423 SMS sent without consent. 24,309 were sent by ADS directly and it…
- Outsource Strategies Ltd Outsource Strategies Ltd made 1,346,503 unwanted marketing calls between 11 February 2021 and 22 March 2022 to numbers registered with the T…
- Outsource Strategies Ltd Outsource Strategies Ltd made 1,346,503 unwanted marketing calls between 11 February 2021 and 22 March 2022 to numbers registered with the T…
- Gap Personnel Holdings Limited The Information Commissioner (the Commissioner) issues a reprimand to Gap Personnel Holdings Limited in respect of infringements of Article …
- Optionis Group Limited The data controller suffered a ransomware attack, which resulted in the exfiltration of personal data. A reprimand was issued in respect of …
- Chief Constable West Mercia Police and Chief Constable Warwickshire Police On 21 June 2021 West Mercia Police and Warwickshire Police erroneously decommissioned a server containing a Warwickshire Police application.…
- Digivo Media Limited Between 24 March 2021 and 7 September 2021 there were 415,041 texts delivered without valid consent – breach of Regulation 22 of PECR. Digiv…
- Digivo Media Limited Between 24 March 2021 and 7 September 2021 there were 415,041 texts delivered without valid consent – breach of Regulation 22 of PECR. Digiv…
- MCP Online Ltd Between 1 January 2022 and 28 September 2022 there were 20,939 calls made to CTPS or TPS registered numbers – breach of Reg 21 and 24 of PEC…
- MCP Online Ltd Between 1 January 2022 and 28 September 2022 there were 20,939 calls made to CTPS or TPS registered numbers – breach of Reg 21 and 24 of PEC…
- Nottinghamshire County Council A social worker sent copies of a Child and Family Assessment report to the mother and her two ex-partners: each the father of one of her two…
- RHAP Ltd RHAP Ltd made 15,288 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £65,000 and issued with an enf…
- RHAP Ltd RHAP Ltd made 15,288 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £65,000 and issued with an enf…
- House Hold Appliances 247 Ltd House Hold Appliances 247 Ltd made 19,069 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £55,000 a…
- House Hold Appliances 247 Ltd House Hold Appliances 247 Ltd made 19,069 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £55,000 a…
- F12 Management Ltd F12 Management Ltd made 1,346,019 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issu…
- F12 Management Ltd F12 Management Ltd made 1,346,019 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issu…
- Cover Appliance Ltd Cover Appliance Ltd made 511,499 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issue…
- Cover Appliance Limited Cover Appliance Ltd made 511,499 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issue…
- SGS Home Protect Ltd SGS Home Protect Ltd made 24,214 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £70,000 and issued…
- SGS Home Protect Ltd SGS Home Protect Ltd made 24,214 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £70,000 and issued…
- Ministry of Justice The Information Commissioner (the Commissioner) issues a reprimand to the Ministry of Justice (the MoJ) in accordance with Article 58(2)(b) …
- Simply Connecting Ltd Simply Connecting Ltd sent 441,830 direct marketing text messages to individuals in breach of regulation 22 of PECR. The company was fined £…
- Simply Connecting Ltd Simply Connecting Ltd sent 441,830 direct marketing text messages to individuals in breach of regulation 22 of PECR. The company was fined £…
- Gloucester City Council The Information Commissioner (the Commissioner) issues a reprimand to Gloucester City Council in respect of infringements of Article 32(1)b,…
- This Is The Big Deal Limited This Is The Big Deal Limited sent or instigated the sending of 41,417,889 unsolicited direct marketing messages (39,906,342 emails and 1,511…
- London Borough of Lewisham During the period of 3 January 2022 to 3 January 2023, 35% of subject access requests (SARs) that London Borough of Lewisham received were n…
- Swinburne, Snowball and Jackson The Information Commissioner (the Commissioner) issues a reprimand to Swinburne, Snowball and Jackson in respect of infringements of Article…
- Recruitment company reprimand The Information Commissioner (the Commissioner) issues a reprimand to a recruitment company in respect of infringements of Article 5(1)(f) a…
- NHS Lanarkshire The Information Commissioner (the Commissioner) issues a reprimand to NHS Lanarkshire in accordance with Article 58 (2)(b) of the UK General…
- My Media World Limited t/a Brand New Tube Reprimand has been issued to the above organisation in respect of Article 32 (1) and Article 32 (1) (d) of the GDPR. My Media World Limited …
- Executive Office On 22 May 2020, the Interim Advocate’s Office sent a newsletter by email to 251 subscribers on its mailing list using the ‘To’ field. The em…
- The Patient and Client Council A reprimand has been issued to The Patient and Client Council in relation to infringements of Article 5 (1)(f) and Article 32 (1) of the UK …
- Fortis Insolvency Limited Fortis Insolvency Limited sent 558,354 direct marketing SMS messages without valid consent with 527,481 received by subscribers between 26 J…
- Fortis Insolvency Limited Fortis Insolvency Limited sent 558,354 direct marketing SMS messages without valid consent with 527,481 received by subscribers between 26 J…
- Nottinghamshire Police The breach in this case was an unauthorised disclosure of the personal data of witnesses via a police officer’s unredacted statement on the …
- Maxen Power Supply Limited Maxen Power Supply Limited used overseas call centres to make unsolicited marketing calls to businesses in contravention of regulations 21 a…
- Crown Glazing Ltd The case was part of Operation Tinago which was formed to assess and analyse complaint trends in relation to the energy and home improvement…
- Crown Glazing Ltd The case was part of Operation Tinago which was formed to assess and analyse complaint trends in relation to the energy and home improvement…
- Maxen Power Supply Limited Maxen Power Supply Limited used overseas call centres to make unsolicited marketing calls to businesses in contravention of regulations 21 a…
- Thames Valley Police The Information Commissioner (the Commissioner) issues a reprimand to Thames Valey Police (TVP) in accordance with Schedule 13(2)(c) of the …
- Parkside Community Primary School A reprimand has been issued to Parkside Community Primary School in relation to the infringements of Article 5 (1)(f), Article 24 (1) and Ar…
- Ice Telecommunications Ltd Ice Telecommunications Ltd made 72,682 unsolicited marketing calls to businesses registered with the CTPS or TPS between 13 September 2021 a…
- Ice Telecommunications Ltd Ice Telecommunications Ltd made 72,682 unsolicited marketing calls to businesses registered with the CTPS or TPS between 13 September 2021 a…
- UK Direct Business Solutions Limited UK Direct Business Solutions Limited made 410,369 unsolicited marketing calls to businesses registered with the CTPS or TPS between 1 March …
- TikTok Information Technologies UK Limited and TikTok Inc (TikTok) The Information Commissioner’s Office (ICO) has issued a £12,700,000 fine to TikTok Information Technologies UK Limited and TikTok Inc (TikT…
- Shropshire Council The Information Commissioner’s Office (ICO) has issued an enforcement notice to Shropshire Council for its poor handling of requests made un…
- Norfolk County Council Norfolk County Council has only responded to 260 out of 511 SARs it received within the statutory timescales from 6 April 2021 to 6 April 20…
- Plymouth City Council A reprimand has been issued to Plymouth City Council in relation to the infringements of Article 12 (3) and Article 15 of the UK GDPR. This …
- Ministry of Justice 14 bags of confidential waste were found in an unsecured holding area in the prison, which both prisoners and staff had access to.
- University Hospitals Dorset NHS Foundation Trust The Information Commissioner (the Commissioner) issues a reprimand to University Hospitals Dorset NHS Foundation Trust (the Trust) in accord…
- Join the Triboo Limited Between 1 August 2019 and 19 August 2020, a confirmed total of 107 million direct marketing messages were sent by Join the Triboo Limited an…
- Join the Triboo Limited Between 1 August 2019 and 19 August 2020, a confirmed total of 107 million direct marketing messages were sent by Join the Triboo Limited an…
- Sussex Police In June 2020, the ICO became aware that staff members across both Sussex Police and Surrey Police had access to an app that recorded all inc…
- Surrey Police In June 2020, the ICO became aware that staff members across both Sussex Police and Surrey Police had access to an app that recorded all inc…
- Achieving for Children Due to communication failure and a lack organisational measures, AfC inappropriately disclosed personal data, special category data and crim…
- London Borough of Lewisham The London Borough of Lewisham has been served with an Enforcement Notice as a result of the evidence seen by the Commissioner about its per…
- Gain Capital UK Limited Gain Capital UK have been issued a Reprimand in respect of Articles 32 (2) and 32 (1) (b). An unauthorised third party leveraged an unpatche…
- NHS Highland A formal reprimand has been issued to NHS Highland, which emailed 37 people likely to be accessing HIV services, inadvertently using CC (car…
- University Hospitals Bristol and Weston NHS Foundation Trust Patient records were saved on to an Electronic Document Viewing System. The Trust decided to terminate the use of this system and the record…
- NHS Blood and Transplant The Commissioner has decided to issue NHSBT with a reprimand in accordance with Article 58 of the GDPR, after they inadvertently released un…
- Metropolitan Police Service MPS was unable to ensure that sensitive criminal records were not able to be uploaded correctly to the Police National Database (PND), or am…
- Chartered Institute for Securities & Investment An unauthorised third party exploited a known vulnerability in the Sitefinity software to leverage a bruteforce attack to upload a malicious…
- It's OK Limited Between 1 July 2019 and 1 June 2020, It’s OK Limited engaged in the transmission of 1,752,149 unsolicited calls for direct marketing purpose…
- It's OK Limited Between 1 July 2019 and 1 June 2020, It’s OK Limited engaged in the transmission of 1,752,149 unsolicited calls for direct marketing purpose…
- Monetise Media Limited Between 28 July 2020 and 28 July 2021, Monetise Media Limited engaged in the transmission of a total of 3,506,157 direct marketing emails an…
- Power Leisure Bookmakers Limited The ICO has issued PLB with a reprimand, in accordance with Article 58 of the UK GDPR, following breaches reported to the ICO on 27 August 2…
- Royal Free London NHS Foundation Trust Hysteroscopy scans were saved on to a series of three USB sticks over a period of nine years from May 2013 until the remaining two encrypted…
- Department for Education The DfE permitted third party access to the LRS database outside of the DfE and subsequent processing took place of some of that personal da…
- Department for Work and Pensions A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within…
- Secretary of State for the Home Department On 5 September 2021 an envelope containing four documents classified 'Official Sensitive' (the Documents) was found at a venue in London, by…
- Processing of special category biometric data In November 2022, the Information Commissioner committed to publish all reprimands from 2022 onwards unless there is a good reason not to.
- Chief Constable of Kent Police From October 2020 to February 2021, Kent Police received over 200 SARs, 60% were completed during the statutory deadline. However, some of t…
- London Borough of Lambeth London Borough of Lambeth has only responded to 74% of the SARs it has received within the statutory timescales from 1 August 2020 to 11 Aug…
- Wakefield Council A reprimand was issued after the Council sent papers prepared as a Court bundle, in relation to Child Protection Legal Proceedings, to the p…
- London Borough of Hackney For the period of April 2020 to February 2021, London Borough of Hackney did not respond to over 60% of the SARs submitted to them in the st…
- Secretary of State for the Home Department (Home Office) A reprimand has been issued to the Home Office following investigations that showed between March 2021 and November 2021, they had a signifi…
- Virgin Media Limited Over a 6 month period in 2021, Virgin Media received over 9500 SARs. 14% of these were not responded to during the statutory timeframe. Howe…
- National Crime Agency The exception reports were to highlight where the work of the RPA could not be completed and manual officer intervention was required in ord…
- Ministry of Justice A reprimand has been issued after an unauthorised disclosure of personal information. A bulk amendment facility was used by staff to eff…
- South Wales Police A reprimand has been issued after the disclosure of personal information by South Wales Police on two separate occasions, the first reported…
- Jackson Quinn Jackson Quinn was representing two children in relation to step-parent adoption proceedings at the family court. The case was listed for a f…
- Secretary of State for the Home Department (Home Office) A Home Office employee contacted members of the public as part of the creation of an education programme for staff into the historical backg…
- Crown Prosecution Service A reprimand was issued after an investigation into three separate incidents involving the loss of personal data.
- Ministry of Defence The MoD has been issued with a reprimand following an identified SAR backlog dating back to March 2020. Despite setting up a recovery plan, …
- Grindr LLC The ICO deemed that Grindr has failed to provide effective and transparent privacy information to its UK data subjects in relation to the pr…
- London Borough of Croydon From April 2020 to April 2021, the London Borough of Croydon Council responded to less than half of their SARs within the statutory timescal…
- Direct Clothing Co. (UK) Limited On 19 August 2021, Direct Clothing Co. (UK) Limited (DCCUK) were contacted by a customer who advised that their payment card had been defrau…
- Department of Health and Social Care The ICO has issued the DHSC with a reprimand in relation to data protection compliance matters under the General Data Protection Regulation …
- Allied Health Professionals Allied Health Professionals have been issued with a reprimand for accidentally making data accessible to health care providers when data sub…
- Bolton at Home Bolton at Home has been issued with a reprimand for the inappropriate disclosure of personal data.
- Warrington and Halton Hospitals NHS Foundation Trust An appointments administrator uploaded a patient’s urgent referral form to the wrong patient’s notes.
- North Yorkshire County Council An NYCC employee failed to accurately complete the print to post process and as a result two envelopes containing multiple letters were sent…
- Epsom and St Helier University Hospitals NHS Trust incorrect test result data was passed by Epsom & St Helier University Hospitals NHS Trust (the Trust) to Public Health England (PHE) resulti…
- Chief Constable of North Yorkshire Police North Yorkshire Police has been issued with a reprimand in accordance with Schedule 13 (2) of the DPA 2018.
- NHS National Services Scotland (NHS NSS) The Scottish Government and NHS National Services Scotland (NHS NSS) has been issued with a reprimand in accordance with Article 58(2)(b) of…
- Welsh Language Commissioner The ICO have decided to issue the WLC with a reprimand in accordance with Article 58(2)(b) of the General Data Protection Regulation.
Nothing matches that filter.