Reading: URM has published its analysis of the fines and enforcement actions imposed by the UK Information Commissioner’s Office (ICO) in 2024. The report provides key insights into trends in data protection enforcement, including the sectors most affected, the types of breaches penalised, and the evolving regulatory landscape.
In 2024, the ICO took enforcement action 62 times against 47 organisations. Of these actions, 18 resulted in monetary penalties, bringing in a total of £2.7 million. The analysis highlights a continued focus on breaches of the Privacy and Electronic Communications Regulations (PECR), which accounted for the majority of fines, while only three fines were issued for UK GDPR breaches.
One of the most notable enforcement actions in 2024 was the ICO’s decision to impose substantial fines on public sector organisations, with the Police Service of Northern Ireland (PSNI) receiving the highest fine of the year (£750,000) following a breach described by an independent review as the most significant data protection failure in UK policing history. Whilst the ICO has stated that it primarily relies on reprimands and enforcement notices when taking action against public sector organisations, the decision to issue a financial penalty reflects the seriousness of this breach, which put police officers’ lives at risk.
The analysis also places ICO enforcement activity in a wider European context, where regulators in other jurisdictions imposed significantly higher fines. The ICO’s reluctance to levy substantial fines remains a point of discussion, with Information Commissioner John Edwards stating that he believes financial penalties may not always be the most effective deterrent.
URM will continue to monitor enforcement trends in 2025, particularly in light of the upcoming Data (Use and Access) Act, expected to introduce changes to the UK’s data protection regime.
“By staying informed about the ICO’s enforcement activities and understanding where other entities fall short of regulatory requirements, organisations can review and enhance their own data protection compliance programmes. This kind of detailed statistical focus on the UK regulator’s record is not available elsewhere and will be of great interest to UK organisations, in both the public and private sectors, in learning from others’ failings and improving their data privacy frameworks and strategies for the year ahead” – Lisa Dargan, Director at URM.
