A current guide to UK GDPR fines and penalties — the two-tier structure, how the ICO calculates fines, the biggest UK penalties to date, and the wider enforcement toolkit including reprimands, audits, and civil compensation claims.
UK data protection enforcement includes financial penalties, reprimands, notices and other action. The latest annual report records a substantial increase in the total value of UK GDPR penalty notices, but an individual fine depends on the infringement and the circumstances.
The ICO reported eight UK GDPR penalty notices totalling £32,402,373 in 2025/26, compared with two totalling £3,826,320 in 2024/25. These are financial-year UK GDPR figures, not a combined calendar-year count of every PECR and data protection penalty.
This guide covers the structure of UK GDPR fines, how the ICO calculates them, the most significant penalties to date, and the other enforcement tools the regulator has at its disposal.
The two-tier fine structure
Article 83 of the UK GDPR sets out a two-tier penalty regime. Which tier applies depends on the type of infringement.
The standard maximum is £8.7 million or 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. This tier covers infringements of the more administrative obligations — failures around records, breach notification timing, data protection by design, processor obligations, and similar.
The higher maximum is £17.5 million or 4% of total worldwide annual turnover, whichever is higher. This tier covers infringements of the basic processing principles, the conditions for consent, the rights of data subjects, international transfer rules, and orders from the ICO.
These figures are alternative maximums, not minimum fines. For an undertaking with £10 billion worldwide annual turnover, the higher-tier percentage maximum is £400 million. For £2 million turnover, the applicable higher-tier ceiling is £17.5 million, but any actual penalty must still be effective, proportionate and dissuasive.
These are maximums, not standard amounts. Most fines come in well below the cap. The ICO's Fining Guidance, published in March 2024, sets out how the regulator works from infringement to final figure.
From 5 February 2026, the DUAA increased the maximum PECR penalty from £500,000 to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The fixed sterling maximum is 35 times the previous cap; a particular penalty is not automatically multiplied by 35. See our cookie consent guide.
What sits in the standard tier
The standard maximum of £8.7 million / 2% applies to a defined list of infringements set out in Article 83(4). The list includes:
- Specified controller and processor obligations, including data protection by design, processing records, security, breach notification, DPIAs and DPO requirements. Check the current statutory provisions for the relevant infringement.
- Relevant obligations of certification and code-monitoring bodies under the provisions specified in Article 83(4).
The standard tier includes substantive obligations such as appropriate security, as well as procedural duties. The same facts can also involve a higher-tier processing-principle infringement. A failure is not merely paperwork because it falls in the standard tier.
What sits in the higher tier
The higher maximum of £17.5 million / 4% applies to a defined list set out in Article 83(5):
- The basic principles for processing, including the conditions for consent under Articles 5, 6, 7, and 9.
- Applicable individual-rights provisions, including the amended automated-decision framework.
- International data transfer rules under Articles 44 to 49.
- Applicable obligations under domestic provisions adopted within the GDPR's permitted areas of national legislation.
- Non-compliance with an ICO order or with a temporary or definitive limitation on processing.
Infringements of basic processing principles, relevant individual rights and transfer duties can fall within the higher maximum. Identify the actual provision breached rather than assuming every personal data breach has the same penalty ceiling.
For more on the principles, see our seven principles guide. For the individual rights, see our individual rights guide.
How the ICO calculates a fine
The ICO's Data Protection Fining Guidance, published in March 2024, sets out a five-step approach.
Step 1: Assess the seriousness of the infringement
The ICO categorises the infringement as low, medium, or high seriousness, based on the nature, gravity, and duration of the infringement, the number of data subjects affected, the level of damage suffered, the intentional or negligent character of the conduct, and the categories of personal data affected. Special category data, criminal offence data, and vulnerable individuals push seriousness upwards.
Step 2: Identify the relevant turnover
For a controller or processor forming part of an undertaking, the relevant turnover can be that of the economic unit as a whole. The ICO's guidance explains the assessment and the adjustments it considers for different turnover levels.
Step 3: Calculate the starting point
The ICO combines the seriousness assessment and relevant turnover adjustment to calculate a starting point within its guidance. The £8.7 million and £17.5 million figures are statutory maximums, not floors from which every calculation begins.
Step 4: Adjust for aggravating and mitigating factors
Article 83(2) lists eleven factors the ICO must consider, including remedial action taken, cooperation with the investigation, previous infringements, the manner in which the regulator became aware, and any benefits the controller obtained from the infringement.
Step 5: Apply final adjustments
The figure is checked against the statutory maximum and adjusted for proportionality if needed. The ICO also considers the financial position of the undertaking, particularly for smaller organisations, and may reduce the figure where the maximum would create disproportionate harm.
Proposed and final penalties must be distinguished. British Airways and Marriott received final penalties lower than the earlier notices of intent after representations and the ICO's assessment. Those changes should not be described as successful appeals against the final fines.
Selected major UK data protection penalties
These selected ICO penalties include historical GDPR cases and later UK GDPR action. The rows are not a complete ranking; Capita's figure combines two entities and litigation status is noted where relevant.
| Year | Organisation | Fine | Cause |
|---|---|---|---|
| 2020 | British Airways | £20 million | 2020 final GDPR penalty after a 2018 cyber attack affecting more than 400,000 customers; earlier proposed penalty was about £183 million. |
| 2020 | Marriott International | £18.4 million | 2020 final GDPR penalty for security failures affecting the Starwood reservation database; earlier proposed penalty was about £99 million. The incident's global record count is not a count of unique UK victims. |
| 2023 | TikTok Information Technologies UK | £12.7 million | Children's privacy failures; TikTok withdrew its appeal in September 2026, making the £12.7 million penalty final. |
| 2025 | Capita group (two entities combined) | £14 million | Ransomware attack affecting 6.6 million people; failure to implement appropriate security and timely response. |
| 2025 | Advanced Computer Software | £3.07 million | Ransomware attack disrupting NHS 111; insufficient MFA coverage; affected ~79,000 people. |
| 2025 | 23andMe | £2.31 million | Credential stuffing attack affecting ~155,000 UK users; security failures including absence of mandatory MFA. |
| 2025 | LastPass UK | £1.23 million | £1,228,283 penalty for security failures following 2022 incidents affecting up to 1.6 million UK users; the ICO did not find evidence that customer passwords were decrypted. |
| 2022 | Clearview AI Inc | £7.5 million | 2022 penalty challenged in litigation. The Upper Tribunal ruled for the ICO on jurisdiction in October 2025; a further Court of Appeal challenge was reported by the ICO in February 2026. |
| 2026 | Reddit Inc | £14.47 million | £14,472,500 penalty for children's privacy failures. Reddit appealed on 1 April 2026; the penalty should not be presented as an uncontested final outcome. |
The final 2020 BA and Marriott penalties were £20 million and £18.4 million, rather than the much larger provisional figures. Compare final amounts and like-for-like reporting periods, and distinguish combined group penalties from single-entity penalties.
The 2025 examples include significant security cases, while 2026 enforcement also includes children's privacy. The latest annual total therefore should not be described as exclusively cyber-attack enforcement.
Clearview's procedural position has changed since the 2023 first-instance decision. The Upper Tribunal's 2025 jurisdiction ruling and the further appeal mean it is misleading to describe the penalty as simply and finally overturned.
Penalties other than fines
The ICO's enforcement toolkit goes beyond fines. The other tools — used more often than the headline figures suggest — include:
Reprimands
A formal expression of disapproval published by the ICO. Reprimands carry no monetary penalty but do create a public record and can be cited in future enforcement. The ICO has shifted towards using reprimands rather than fines for public-sector breaches, in line with a 2022 policy decision.
Enforcement notices
An enforcement notice requires specified action within the applicable period. Failure to comply can lead to further regulatory enforcement and a financial penalty. It is not automatically a criminal offence merely because the notice was breached.
Information notices
An information notice requires information for the ICO's functions. Non-compliance can attract regulatory consequences; knowingly or recklessly supplying false information can be a separate criminal offence under the Data Protection Act.
Audits
The ICO can conduct audits and has statutory assessment powers. Compulsory assessments are subject to the conditions and exclusions in the relevant legislation; they are not an unlimited power to audit anyone for any purpose.
Suspension or prohibition of processing
The ICO can require an organisation to stop processing entirely, including the cross-border transfer of personal data.
Criminal prosecution
A narrow set of offences under the Data Protection Act 2018 — including unlawful obtaining of personal data and reidentification of de-identified data — carry criminal liability separate from regulatory fines.
The pattern of recent enforcement is mixed: reprimands for many public bodies and lower-risk breaches, large fines for systemic security failures in the private sector. For the underlying breach response question, see our data breach guide.
Civil compensation claims
Article 82 of the UK GDPR gives individuals the right to claim compensation from a controller or processor for material or non-material damage suffered as a result of an infringement.
Two important features of Article 82:
- The right exists in addition to ICO fines and any criminal sanctions. An organisation can face regulatory action and individual claims for the same incident.
- Liability is joint and several where multiple controllers or processors are responsible. A claimant can pursue any of them for the full sum, with the parties sorting out the apportionment afterwards.
Compensation requires the applicable legal test to be met, including damage caused by the infringement. Lloyd v Google concerned a representative claim under the Data Protection Act 1998, so its conclusions should not be presented as a complete ruling on every UK GDPR claim.
There is no standard compensation tariff for a data breach. Any award depends on the proven infringement, resulting damage, causation and the court's assessment. An ICO fine is separate from compensation and is not paid to affected individuals.
The latest annual enforcement figures
The 2025/26 annual report allows a consistent financial-year comparison of UK GDPR penalty notices.
In 2024/25, the ICO reported two UK GDPR penalty notices totalling £3,826,320. The £750,000 public-sector penalty concerned the Police Service of Northern Ireland, not the Ministry of Defence. The MoD's separate 2023 email-disclosure penalty was £350,000.
In 2025/26, the ICO reported eight UK GDPR penalty notices totalling £32,402,373. This is a different measure from calendar-year totals covering PECR, and should not be mixed with them.
A small number of large cases can materially change annual totals. The report includes Capita, Reddit,23andMe and LastPass, involving different circumstances. These figures alone do not establish why enforcement strategy changed or predict the outcome of a future case.
Organisations should address the risks in their own processing and use the ICO's decisions and guidance to understand expected safeguards. Size and resources can be relevant to proportionality, but do not provide a general exemption from compliance.
For the wider context on who must comply and what they must do, see our hub guide to UK GDPR and our scope guide.
Frequently asked questions
What's the maximum GDPR fine?
£17.5 million or 4% of worldwide annual turnover, whichever is higher. This is the UK GDPR higher tier; the standard tier maximum is £8.7 million or 2%.
What was the biggest UK GDPR fine?
British Airways received a £20 million final penalty in 2020, and Marriott £18.4 million. Capita's 2025 total of £14 million combined two entities. Reddit received a £14,472,500 penalty in 2026 and appealed; compare final, proposed and contested amounts carefully.
How does the ICO calculate fines?
Using a five-step methodology set out in its March 2024 Fining Guidance: assessing seriousness, identifying turnover, calculating a starting point as a percentage of turnover, adjusting for aggravating and mitigating factors, and applying final proportionality checks.
Are GDPR fines getting bigger?
The latest financial-year UK GDPR total rose from £3,826,320 across two notices in 2024/25 to £32,402,373 across eight notices in 2025/26. This does not mean that every penalty is increasing or that a breach automatically results in a fine.
Can individuals sue for GDPR breaches?
Yes. A person can seek compensation for material or non-material damage caused by an infringement, subject to the applicable legal requirements. The appropriate court and procedure depend on the jurisdiction and claim; an ICO complaint is not itself a compensation award.
Do GDPR fines apply to small businesses?
Yes. There is no general small-business exemption. The statutory figures are maximum penalties, not minimum amounts, and an actual fine must be proportionate to the circumstances. Percentage-based maxima may be higher for large undertakings.
Related guides
- GDPR cookie consent in the UK: rules after the DUAA 2025
- GDPR data breach: what to do in the first 72 hours
- GDPR privacy notices: what they must contain and how to write one
Make sure your team understands UK data protection law and how to handle personal data safely.
Explore the GDPR & Data Protection Course →Sources & references
- ICO: Data Protection Fining Guidance
- ICO: Annual Report 2025/26, pages 59–60
- ICO: Annual Report 2025/26 correction
- ICO: Annual Report 2020/21, BA and Marriott penalties
- ICO: Reddit penalty and appeal status
- ICO: Capita group penalties
- ICO: Advanced penalty
- ICO:23andMe penalty
- ICO: LastPass penalty
- Upper Tribunal: Clearview jurisdiction decision, October 2025
- ICO: Clearview appeal update, February 2026
- ICO: MoD and PSNI penalties distinguished
- UK GDPR Article 83: administrative fines
- Supreme Court: Lloyd v Google,2021
- ICO: TikTok accepts £12.7 million penalty, September 2026
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.