Local Government Data Unit - Wales ↗
From the ICO's notice: Welsh organisation reprimanded after cyber-attack exposed children’s information.
Source · Data protection and FOI regulatory action
ICO enforcement and regulatory actions
Information Commissioner's Office actions under data protection and FOI law, including monetary penalties, enforcement notices, information notices, reprimands and undertakings.
Information notices require information for an ICO investigation. FOI regulatory coverage is partial.
236 actions
64 monetary penalties
£56,190,093 in recorded penalties
Enforcement actions 236 actions
Ogi Networks Limited ↗
From the ICO's notice: Welsh organisation reprimanded after cyber-attack exposed children’s information.
Metropolitan Police Service ↗
From the ICO's notice: The Information Commission has issued a combined Reprimand and Enforcement Notice to the Metropolitan Police Service following findings of infringement of sections 35(1), 40 and 64(1) of the Data Protection Act 2018 relating to the unauthorised use of a third-party platforms to share personal information relating to individuals suspected of shoplifting offences.
Metropolitan Police Service ↗
From the ICO's notice: The Information Commission has issued a combined Reprimand and Enforcement Notice to the Metropolitan Police Service following findings of infringement of sections 35(1), 40 and 64(1) of the Data Protection Act 2018 relating to the unauthorised use of a third-party platforms to share personal information relating to individuals suspected of shoplifting offences.
ACRO Criminal Records Office ↗
From the ICO's notice: The Information Commissioner (the Commissioner) issues a reprimand to ACRO Criminal Records Office for infringements of Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR. This enforcement action follows a cyber incident in which the personal data of approximately 10,000 UK data subjects may have been affected.
Elderly Aids Limited ↗
From the ICO's notice: Contravention of Regulations 21 and 24. Elderly Aids Limited promoted call blocking devices. Elderly Aids Limited made 758,053 unsolicited direct marketing calls to subscribers who were registered with the TPS / CTPS and who had not notified EAL that they were willing to receive such calls, and 20 complaints being made as a result.
Elderly Aids Limited ↗
From the ICO's notice: Contravention of Regulations 21 and 24. Elderly Aids Limited promoted call blocking devices. Elderly Aids Limited made 758,053 unsolicited direct marketing calls to subscribers who were registered with the TPS / CTPS and who had not notified EAL that they were willing to receive such calls, and 20 complaints being made as a result.
Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS) ↗
From the ICO's notice: Incident 1 (ICO Ref: INV/0034/2025), concerning the service of unredacted documents in support of a Stalking Protection Order application; and Incident 2 (ICO Ref: INV/0138/2024), concerning the disclosure of email addresses when contacting victims of the Honeytrap Matter.
Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS) ↗
From the ICO's notice: Incident 1 (ICO Ref: INV/0034/2025), concerning the service of unredacted documents in support of a Stalking Protection Order application; and Incident 2 (ICO Ref: INV/0138/2024), concerning the disclosure of email addresses when contacting victims of the Honeytrap Matter.
Geoffrey Smith ↗
From the ICO's notice: A council worker who unlawfully accessed hundreds of personal records has been handed a suspended sentence. Geoffrey Smith, 31, from Ledbury, Herefordshire, was a new employee at Herefordshire Council working in the Children and Young People directorate. His unlawful conduct was discovered after concerns were raised within the council about potential unauthorised access to a referral case, prompting an investigation into other records he had accessed. That investigation revealed that, over a four-day period, Smith unlawfully accessed approximately 490 records and downloaded 94 documents. The records related to his family members and families known to him and included children and adults. The records accessed involved highly sensitive material such as medical records, social worker reports and child and family assessments. On 27 May 2026, Smith pleaded guilty to an offence under Section 1 of the Computer Misuse Act 1990, relating to the unlawful accessing of personal data held on computers. Smith was sentenced at Worcester Magistrates' Court following a hearing on Friday 17 July to two months imprisonment suspended for 12 months, 120 hours unpaid work, £2000 costs plus a victim surcharge of £154.
Debbie Okparavero and Maliha Islam – Proceeds of Crime Act ↗
From the ICO's notice: We have secured successful outcomes at Proceeds of Crime Act (POCA) hearings, resulting in a total of £118,852.32 in confiscation orders being handed to Greater Manchester based former RAC employees Debbie Okparavero and Maliha Islam. The POCA hearings followed an 8 October 2024 hearing in which Okparavero and Islam were sentenced to six-month prison sentences, suspended for 18 months, and each ordered to complete 150 hours of unpaid work. Both defendants had previously pleaded guilty to a conspiracy to commit offences under s1 of the Computer Misuse Act 1990 and the Data Protection Act 2018, for unlawfully copying and selling almost 30,000 lines of personal information. The outcome of the POCA hearing shows that the ICO will use the full range of its enforcement powers to bring criminals to account and recoup money, calculated by the Court, which reflects the benefit gained from illegal activity. At the hearing held on Friday 29 May 2026 at Manchester Crown Court, Okparavero, from Salford, was ordered to pay £85,727.32, plus costs of £3,550.00. If payment of the confiscation order is not made within three months Okparavero will serve 18 months in prison and still be liable to pay the full amount. At a previous hearing in November 2025 Islam, from Manchester, was ordered to pay £33,125.00 within three months plus costs of £2,797.50. Failure to do so would have carried a 10 month prison sentence. In respect of Islam, the confiscation order has been paid in full.
Thermotech Wall and Loft Surveys Ltd ↗
From the ICO's notice: In April 2025, the ICO carried out a search warrant to obtain evidence in relation to TWLS and its compliance with PECR. Following an extensive investigation, it was revealed that between 1 October 2024 to 31 March 2025, TWLS instigated 575,062 unsolicited direct marketing calls to numbers registered with the TPS for more than 28 days. This resulted in 132 complaints being made to the TPS and the ICO reporting tools.
Thermotech Wall and Loft Surveys Ltd ↗
From the ICO's notice: In April 2025, the ICO carried out a search warrant to obtain evidence in relation to TWLS and its compliance with PECR. Following an extensive investigation, it was revealed that between 1 October 2024 to 31 March 2025, TWLS instigated 575,062 unsolicited direct marketing calls to numbers registered with the TPS for more than 28 days. This resulted in 132 complaints being made to the TPS and the ICO reporting tools.
KRA Consultancy Ltd ↗
From the ICO's notice: KRA Consultancy Ltd was fined £300,000 for sending over 5.5 million unsolicited direct marketing and fake bailiff texts in breach of regulations 22 and 23 of PECR. The messages resulted in over 60,000 complaints to the 7726 spam reporting service.
Norfolk Constabulary ↗
From the ICO's notice: Norfolk Constabulary has been issued with a Reprimand, after sensitive personal data became inadvertently disclosed within Excel spreadsheets, in response to Freedom of Information requests.
Suffolk Constabulary ↗
From the ICO's notice: Suffolk Constabulary has been issued with a Reprimand, after sensitive personal data became inadvertently disclosed within Excel spreadsheets, in response to Freedom of Information requests.
KRA Consultancy Ltd ↗
From the ICO's notice: KRA Consultancy Ltd was issued with an enforcement notice for sending over 5.5 million unsolicited direct marketing and fake bailiff texts in breach of regulations 22 and 23 of PECR. The messages resulted in over 60,000 complaints to the 7726 spam reporting service.
Rizwan Manjra – Proceeds of Crime Act ↗
From the ICO's notice: We have secured a £355,880.10 confiscation order against former Manchester motor insurance worker, Rizwan Manjra, who was previously found guilty of securing unauthorised access to personal information on his work computer systems for his own financial gain. The order was granted at a Proceeds of Crime Act (POCA) hearing at Manchester Crown Court on Friday 15 May 2026. This followed Manjra’s 2024 guilty plea to an offence under the Computer Misuse Act 1990 of causing a computer to perform a function with intent to secure unauthorised access to personal information. The ICO pursued confiscation under POCA to ensure that people who profit from the unlawful use of personal information do not retain the benefits from their criminal activity. The order reflects the financial advantage the defendant gained through the illegal access and onward sale of personal information. The confiscation order must be paid within three months. Should Manjra fail to pay, he will face a default prison sentence of three years and six months and will still be liable for the full amount. Manjra was also ordered to pay £1,500 in costs within six months. The action follows the ICO’s successful prosecution in December 2024, in which the defendant received a suspended prison sentence for unlawfully accessing personal information held on his employer’s computers.
South Staffordshire Plc and South Staffordshire Water Plc ↗
From the ICO's notice: The Information Commissioner’s Office (ICO) has imposed a fine of £963,900 on South Staffordshire Plc & South Staffordshire Water Plc for the infringement of Article 5(1)(f) and Article 32(1) of the UK General Data Protection Regulation. This enforcement action follows a cyber incident in which personal data relating to approximately 633,887 UK data subjects was exfiltrated.
SA Assistance Ltd ↗
From the ICO's notice: Contravention of Regulation 21A and 24 of the PECR. SA Assistance Ltd instigated calls to individuals about claims management services without consent.
Energy Prices Direct Limited ↗
From the ICO's notice: Contravention of Regulations 21 and 24 of the PECR. Energy Prices Direct Limited offer energy switching services. Information demonstrated that they had obtained information from the public domain and list providers, but failed to screen the data against the TPS/CTPS prior to making a marketing call.
The University Hospitals Birmingham NHS Foundation Trust ↗
From the ICO's notice: The Information Commissioner’s Office (ICO) has issued an enforcement notice to University Hospitals Birmingham NHS Foundation Trust for its poor handling of requests made under the Freedom of Information Act (FOIA) 2000.
The Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust ↗
From the ICO's notice: The Information Commissioner’s Office (ICO) has issued an enforcement notice to Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust for its poor handling of requests made under the Freedom of Information Act (FOIA) 2000.
Jacksons Marketing Ltd ↗
From the ICO's notice: Jacksons Marketing Ltd was fined £130,000 for making 232,776 unsolicited live direct marketing calls between 29 January 2024 and 12 December 2024 to telephone numbers that had been registered with the Telephone Preference Service (TPS) for more than 28 days. This resulted in 12 complaints being made to the TPS and the Commissioner.
Jacksons Marketing Ltd ↗
From the ICO's notice: Jacksons Marketing Ltd was fined £130,000 for making 232,776 unsolicited live direct marketing calls between 29 January 2024 and 12 December 2024 to telephone numbers that had been registered with the Telephone Preference Service (TPS) for more than 28 days. This resulted in 12 complaints being made to the TPS and the Commissioner.
Reddit, Inc. ↗
From the ICO's notice: We imposed a £14,472,500.00 penalty to Reddit, Inc. for infringing Articles 5(1)(a), 6, and 8, and Article 35 of the UK GDPR. We found that Reddit, Inc.: failed to apply any robust age assurance mechanism and therefore did not have a lawful basis for processing the personal information of children under the age of 13; and failed to carry out a data protection impact assessment to assess and mitigate risks to children before January 2025. These failures meant Reddit was using children’s data unlawfully, potentially exposing children to inappropriate and harmful content.
The Commissioner of Police for the City of London ↗
From the ICO's notice: A reprimand has been issued to The Commissioner of Police for the City of London (COLP), after it failed to meet its data protection obligations in responding to SARs within the statutory timeframe during the period 1 April 2023 to 31 July 2025, thereby contravening Article 12(3) UK GDPR and s45(3) DPA 2018.
Calderdale Council ↗
North Tees and Hartlepool NHS Foundation Trust ↗
Christopher Munro and William Chipoma ↗
From the ICO's notice: Two further people have been convicted following our extensive investigation into the unlawful accessing and sale of personal information obtained from over 400 garages across the UK, as well as claims management and insurance companies. Christopher Munro, 37, of Knutsford, Cheshire, and William Chipoma, 35, of Enfield, London, were charged after investigations uncovered their involvement in the theft and sale of personal data within the claims management sector. Our enquiries revealed that Munro and Chipoma deliberately sought employment with the intention of stealing and selling personal data. Munro, while working for two different companies during 2015 and 2016, accessed thousands of records without legitimate authority or consent, receiving payments totalling £16,000. He made multiple employment applications to claims management and insurance companies but left after short periods when unable to access personal data. He was charged with four offences: two under the Computer Misuse Act 1990 and two under Section 55 of the Data Protection Act 1998. Chipoma illegally accessed records and sold personal data between 2015 and 2017, receiving payments totalling £70,550. He was also charged with four offences: two under the Computer Misuse Act 1990 and two under Section 55 of the Data Protection Act 1998. Both men pleaded guilty to all offences at an earlier hearing. Following this, both men appeared at Minshull Street Crown Court on 11 February 2026 where Chipoma was handed a 10 month prison sentence, suspended for 12 months, as well as being ordered to complete 240 hours of unpaid work. Whilst Munro was handed a 32 week prison sentence, suspended for 12 months, as well as being ordered to complete 150 hours of unpaid work. This brings the total number of people prosecuted in our largest nuisance call investigation to 10. Three people have also been cautioned in relation to this case. ICO Financial Investigators as well as external Financial Investigators are looking to recoup the financial benefits obtained by these offenders by utilising the Proceeds of Crime Act 2002.
Chief Constable of Cumbria Constabulary ↗
MediaLab.AI, Inc. ↗
From the ICO's notice: £247,590 penalty imposed on MediaLab.AI, Inc. in respect of infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR. MediaLab operated the Imgur social media platform in the UK prior to 30 September 2025 and allowed children under the age of 13 to access the platform, purportedly subject to a requirement for parental supervision and whilst claiming to rely on the Article 6(1)(a) UK GDPR (consent) lawful basis. However, MediaLab had no means of determining the age of its users and thus no means of ensuring that it obtained parental consent in respect of users under the age of 13, as required by Article 8 UK GDPR due to the fact that MediaLab offered infrormation society services (i.e. the Imgur platform) directly to children in the UK purportedly on the basis of consent. Therefore, MediaLab did not have a valid lawful basis for processing the personal data of children under the age of 13 and thus processed their personal data unlawfully. In addition, MediaLab failed to carry out a DPIA prior to engaging in a form of high risk processing, specifically, processing the personal data of children under the age of 18 where it intended to offer online services to those children, placing MediaLab in breach of Article 35(1) UK GDPR. The period of infringement began on 27 September 2021, when MediaLab acquired Imgur, Inc. and continued until 30 September 2025, when MediaLab implemented a geo-block which prevents individuals in the UK from accessing the Imgur platform. The penalty was reduced from the £393,000 proposed in the NOI dated 10 September 2025 following consideration of MediaLab's representations and updated financial information.
TMAC Ltd ↗
From the ICO's notice: TMAC contravened regulations 21 and 24 of PECR and the ICO issued a monetary penalty of £100,000 and an enforcement notice. Between 8 February 2024 and 24 September 2024, TMAC used a public telecommunications service for the purposes of making 260,332 unsolicited calls for direct marketing purposes to subscribers where the number allocated to the subscriber in respect of the called line was a number listed on the register of numbers kept by the Commissioner in accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. TMAC also failed, as required by regulation 24 of PECR, to provide the recipient of the calls with the particulars specified at regulation 24(2) of PECR.
TMAC Ltd ↗
From the ICO's notice: TMAC contravened regulations 21 and 24 of PECR and the ICO issued a monetary penalty of £100,000 and an enforcement notice. Between 8 February 2024 and 24 September 2024, TMAC used a public telecommunications service for the purposes of making 260,332 unsolicited calls for direct marketing purposes to subscribers where the number allocated to the subscriber in respect of the called line was a number listed on the register of numbers kept by the Commissioner in accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. TMAC also failed, as required by regulation 24 of PECR, to provide the recipient of the calls with the particulars specified at regulation 24(2) of PECR.
London Borough of Lambeth ↗
Home Office ↗
Allay Claims Ltd ↗
From the ICO's notice: MPN and EN issued to Allay Claims Ltd due to a large volume of unsolicited SMS being sent, promoting PPI tax refund services
Allay Claims Ltd ↗
From the ICO's notice: MPN and EN issued to Allay Claims Ltd due to a large volume of unsolicited SMS being sent, promoting PPI tax refund services
Staines Health Group ↗
From the ICO's notice: Reprimand Issued - Staines Health Group sent excessive medical details about a terminally ill patient to their insurance company. The patient requested that five years of medical records be sent to them to review, before being sent to the insurer in order to progress the claim. But, instead of five years medical history being sent to the patient, Staines Health Group sent 23 years of medical records direct to the insurer. The patient believed the excessive disclosure of unnecessary medical records led to a reduction in the payout of their claim. Failures of Staines Health Group included a lack of written process for staff to follow when handling insurance requests and a lack of regular refresher data protection training for staff.
Police Service of Scotland ↗
From the ICO's notice: The Information Commissioner's Office (ICO) has fined the Police Service of Scotland £66,000 and issued a Reprimand for serious failures in the handling of sensitive personal information.
ZMLUK Limited ↗
From the ICO's notice: ZMLUK Limited were issued with an MPN due to sending unsolicited emails promoting energy saving products.
Post Office Limited ↗
From the ICO's notice: On 25 April 2024, Post Office Limited (POL) uploaded an unredacted copy of a legal Settlement Deed to its corporate website instead of the intended redacted version. The Settlement Deed contained the personal data of 502 claimants who were part of the 2017 group litigation brought against POL which exposed the Horizon IT Scandal.
LastPass UK Ltd ↗
From the ICO's notice: £1,228,283 penalty issued to password management provider LastPass UK Ltd on 20 November 2025 in respect of infringements of Article 5(1)(f) and Article 32(1)(f) UK GDPR. LastPass' failure to implement appropriate technical and organisational security measures allowed a threat actor to exfiltrate personal data relating to approximately 1.6 million UK customers from its backup database. However, due to LastPass' "zero knowledge" encryption system, the most sensitive personal data stored in LastPass customers' password vaults remained encrypted at all times, even after exfiltration by the threat actor.
London Borough of Redbridge ↗
Lead Pronto Ltd ↗
From the ICO's notice: Lead Pronto Ltd were issued with an MPN and an EN due to sending unsolicited SMS promoting Government funded boiler grants.
Lead Pronto Ltd ↗
From the ICO's notice: Lead Pronto Ltd were issued with an MPN and an EN due to sending unsolicited SMS promoting Government funded boiler grants.
Capita plc and Capita Pension Solutions Ltd ↗
From the ICO's notice: The Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m following a cyber attack in April 2023 which saw hackers gain access to over 6m people’s data.
South Wales Police ↗
From the ICO's notice: We issued an enforcement notice to South Wales Police (SWP) over serious delays in handling subject access requests (SARs). Our investigation revealed that between April 2023 - March 2024, SWP only responded to 29% of SARs within the statutory timeframe. We also found that as of August 2025, the force had 352 overdue SARs, with one dating back nearly two years. We ordered SWP to clear this backlog by June 2026.
Qonain Hussain ↗
From the ICO's notice: A former insurance claims advisor has been sentenced for unlawfully accessing personal injury claim records. Qonain Hussain, of Wakefield, West Yorkshire, was employed by BISL Limited (BISL), an insurance intermediary which arranges and administers car insurance policies. BISL launched an investigation after being contacted by a law firm that had received complaints from customers being contacted by a third party about their accident claims. The ICO’s investigation found that between 1 April 2020 and 5 November 2020, 1,550 customer records had been accessed by Hussain. Although he was required to access customer records when handling claims, a large portion of records were found to have been accessed outside of his scheduled working hours or while he was on annual leave. On 30 July 2025 at Leeds Crown Court, Hussain pleaded guilty to one offence of unlawfully obtaining personal data, in breach of s170(1) of the Data Protection Act 2018. Hussain was ordered to pay a fine of £1,500 at sentencing hearing on 8 October 2025.
Bharat Singh Chand ↗
From the ICO's notice: Bharat Singh Chand is a self-employed lead generator. Between 3 December 2023 and 3 July 2024, he sent or instigated the sending of 966,449 direct marketing SMS messages in breach of regulations 22 and 23 of PECR. This resulted in 19,138 complaints to the 7726 spam reporting service. He was fined £200,000 and issued with an enforcement notice.
Actions by type
The ICO has taken 236 enforcement actions tracked here, including 64 monetary penalties and 102 reprimands. Recorded penalties: £56,190,093.
Each entry is counted once. If the ICO lists several action types, monetary penalties take precedence, followed by enforcement notices.
Read the chart values
| Action type | Actions |
|---|---|
| Monetary Penalty Notice | 64 |
| Enforcement Notice | 58 |
| Information Notice | 6 |
| Reprimand | 102 |
| Criminal Prosecution | 6 |