UK GDPR fine and enforcement statistics — how many fines the ICO has issued, the biggest UK GDPR fines to date, the UK GDPR vs PECR split, the new DUAA maximums and how the UK compares with Europe, fully sourced from official data.
The ICO publishes individual enforcement decisions and annual operational totals. This page uses its Annual Report 2025/26 for the latest financial-year figures, original penalty notices for major cases and DLA Piper’s January 2026 study for European context. A notice issued, a combined penalty against several companies and revenue recognised in accounts are different measures.
Key facts and figures
- £20 million — the largest UK GDPR fine ever issued, against British Airways in October 2020.
- 8 UK GDPR penalty notices totalling £32,402,373 were issued in financial year 2025/26, according to the ICO annual report.
- £14.47 million — the Reddit penalty issued in February 2026; Reddit appealed in April 2026.
- £3,826,320 — the total of two UK GDPR penalty notices issued in 2024/25, for comparison with £32,402,373 in 2025/26.
- 10 PECR monetary penalty notices totalling £1,445,000 were issued in 2025/26, alongside eight UK GDPR notices.
- £17.5 million or 4% of worldwide annual turnover, whichever is higher — the higher PECR maximum available from 5 February 2026.
- €1.2 billion in GDPR fines were issued across Europe in 2025, taking the cumulative total since 2018 to €7.1 billion.
- 3,677 unique Q4 2025 incidents appear in the ICO trends extract, up 16.4% year on year; this is not a fine count.
Figures and case status were checked on 15 October 2026. Financial-year totals describe issued notices. Individual cases can be appealed, and an issued penalty is not necessarily money collected by the regulator.
What are the biggest GDPR fines in the UK?
£20 million — the penalty issued to British Airways in October 2020 — remains the largest UK GDPR fine ever, nearly six years on. Marriott International's £18.4 million fine, issued the same month, holds second place. Both stemmed from large-scale cyber attacks, and both were substantially reduced from the ICO's original proposals: £183 million in BA's case and £99 million in Marriott's, cut after representations and the pandemic's impact on the aviation and hospitality sectors.
| Fine | Organisation | Year | What happened |
|---|---|---|---|
| £20 million | British Airways | 2020 | Cyber attack affecting 400,000+ customers; inadequate security controls. Reduced from a proposed £183 million. |
| £18.4 million | Marriott International | 2020 | Guest-reservation database breach affecting c.339 million records worldwide. Reduced from a proposed £99 million. |
| £14.47 million | 2026 | Children’s data protection failures; notice issued 23 February 2026 and appealed in April 2026. | |
| £14 million combined | Capita (two entities) | 2025 | £8 million against Capita plc and £6 million against Capita Pension Solutions after the 2023 ransomware incident affecting 6.6 million people. |
| £12.7 million | TikTok | 2023 | Children’s data protection failures; the ICO’s September 2026 update estimated up to 1.75 million UK under-13 users in 2020. Appeals withdrawn; penalty final. |
| £7.5 million | Clearview AI | 2022 | Jurisdiction litigation: the Upper Tribunal ruled for the ICO in October 2025; further Court of Appeal proceedings were reported in 2026. |
| £3.076 million | Advanced Computer Software | 2025 | 2022 ransomware incident affecting 79,404 people, including disruption to NHS services; security and MFA shortcomings. |
| £2.31 million | 23andMe | 2025 | Security failings affecting 155,592 UK users following a 2023 credential-stuffing attack. |
The table lists major issued penalties and keeps combined group penalties and appeal status visible. Reddit is a new 2026 entry; TikTok’s penalty became final after its appeals were withdrawn in September 2026. Clearview should not be described simply as a finally overturned fine: subsequent jurisdiction proceedings changed the position.
What recent UK GDPR fines has the ICO issued?
The annual report records eight UK GDPR notices totalling £32,402,373 in 2025/26. The examples below span calendar 2025 and illustrate different cases; they are not an exhaustive list of notices for that financial year. Capita’s combined amount covers two separate companies.
- Capita — £14 million (two group entities combined), for security failings exposed by the March 2023 ransomware attack.
- Advanced Computer Software — £3.07 million, after a ransomware attack disrupted NHS 111 services.
- 23andMe — £2.31 million, for security failures behind a credential-stuffing attack on UK users' genetic data.
- LastPass UK — £1.23 million, issued 20 November 2025 over the 2022 breach affecting up to 1.6 million UK users.
- DPP Law — £60,000, issued in April 2025 after attackers entered the law firm's network through an admin account without multi-factor authentication.
- Birthlink — £18,000 in June 2025 after destruction of approximately 4,800 records, up to 10% of which may have been irreplaceable.
These cases concern different duties and types of harm. The presence of smaller organisations in the list shows that size is not an exemption, while the amount of a penalty depends on the statutory factors and proportionality assessment. A short selection of cases cannot establish a general trend in enforcement strategy.
How has ICO fining activity changed year by year?
For a like-for-like annual comparison, the ICO issued eight UK GDPR penalty notices worth £32,402,373 in 2025/26 and two worth £3,826,320 in 2024/25. These operational figures are different from penalty income recognised or collected in the financial statements, which may reflect appeals and other accounting adjustments.
The same 2025/26 report records two UK GDPR enforcement notices and seven reprimand outcomes. Its separate correction states that the comparative number of reprimand outcomes for 2024/25 should be 12, rather than the nine originally printed. Complaint receipts increased to 76,743 from 42,315.
| Measure | Figure | Period |
|---|---|---|
| UK GDPR monetary penalties issued | 8 notices; £32,402,373 | FY 2025/26 |
| UK GDPR monetary penalties issued, prior year | 2 notices; £3,826,320 | FY 2024/25 |
| UK GDPR enforcement notices | 2 | FY 2025/26 |
| Reprimand outcomes | 7; prior year corrected to 12 | FY 2025/26 |
| Data protection complaints received | 76,743; prior year 42,315 | FY 2025/26 |
| Unique incidents in published trends extract | 3,677; up 16.4% year on year | Q4 2025 |
Issued penalties, reprimands, complaints and incident reports describe separate parts of the regulator’s work. Differences in timing and coverage mean they should not be combined into an enforcement rate or used to infer that every reported breach eventually receives a particular outcome.
Are most ICO fines under UK GDPR or PECR?
In 2025/26 the ICO issued ten PECR monetary penalty notices and eight UK GDPR penalty notices. PECR therefore accounted for more of these notices, but UK GDPR accounted for substantially more of their stated value: £32,402,373 compared with £1,445,000. This comparison excludes other types of action and does not measure fines collected.
From 5 February 2026, the higher PECR penalty maximum became £17.5 million or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher. This replaces the former £500,000 maximum for relevant infringements. A higher legal ceiling does not predict the size or number of future fines.
What is the maximum GDPR fine in the UK?
The higher UK GDPR maximum is £17.5 million or 4% of an undertaking’s total worldwide annual turnover, whichever is higher. The standard maximum is £8.7 million or 2%, whichever is higher. The applicable tier depends on the infringement: security can engage both Article 32 duties and the higher-tier integrity and confidentiality principle, so it is not simply a procedural issue.
In practice, fines land well below the caps. The ICO's Data Protection Fining Guidance, published in March 2024, sets out a five-step methodology working from the seriousness of the infringement and the organisation's turnover through aggravating and mitigating factors to a final proportionality check. Even the largest UK fine to date — £20 million against British Airways in October 2020 — was a fraction of the £183 million originally proposed. For a full walkthrough of the two tiers and how the ICO calculates a penalty, see our guide to GDPR fines and penalties in the UK.
How do UK fines compare with the rest of Europe?
DLA Piper’s January 2026 survey reported approximately €1.2 billion in fines across its surveyed European jurisdictions in 2025, and €7.1 billion cumulatively from 25 May 2018 to 10 January 2026. This is a commercial law firm’s cross-jurisdiction study, not a single regulator’s official statistical series. Its calendar periods should not be directly compared with the ICO’s financial-year totals.
Cross-country differences depend on the cases, jurisdiction, organisations involved and procedural stage. Issued penalties can later be challenged or varied. These figures alone cannot establish that one country’s regulator is more lenient or that its organisations comply better.
How many data breaches are reported to the ICO?
The ICO’s Q4 2025 trends extract contains 3,677 unique incidents, compared with 3,159 in Q4 2024. It classifies 2,821 as non-cyber and 856 as cyber. These are reported incident categories, not enforcement outcomes or a count of every UK breach.
The dataset still marks 1,479 of those incidents as not yet assigned a decision. It therefore does not support a final statement that 70% ended in no action. The annual number of notices and a quarter’s incident reports also concern different cases and time periods, so dividing one by the other would not give a valid fines rate.
Frequently asked questions
What is the biggest GDPR fine in the UK?
£20 million, issued to British Airways in October 2020 following a cyber attack affecting more than 400,000 customers. It was reduced from an original proposal of £183 million. Marriott International's £18.4 million fine, also from October 2020, is the second largest.
How many GDPR fines has the ICO issued?
For financial year 2025/26, the ICO’s annual report records eight UK GDPR penalty notices totalling £32,402,373. That is a count of notices issued during the year, not a cumulative total since 2018 or the amount actually collected.
What is the maximum GDPR fine in the UK?
The higher maximum is £17.5 million or 4% of an undertaking’s worldwide annual turnover, whichever is higher. The standard maximum is £8.7 million or 2%, whichever is higher. The infringement determines the tier, and the actual penalty must be effective, proportionate and dissuasive.
What are PECR fines and how big can they be?
PECR covers electronic marketing and storage/access technologies such as cookies, among other matters. The higher maximum for relevant infringements rose from £500,000 to £17.5 million or 4% of an undertaking’s worldwide annual turnover, whichever is higher, on 5 February 2026.
Where does the money from ICO fines go?
Penalty receipts are payable to the government’s Consolidated Fund. Under a Treasury arrangement effective from 2022/23, the ICO can retain up to £7.5 million a year of collected penalties to cover specified enforcement and litigation costs. Issued fines and cash received are different amounts.
Do small organisations and charities get GDPR fines?
Yes. In 2025 the ICO fined DPP Law £60,000 and Birthlink £18,000. Organisation size is relevant to proportionality but does not guarantee a particular penalty or exempt an organisation from its duties.
Related guides
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- Human Error Data Breach Statistics: What the ICO Data Shows
- GDPR fines and penalties in the UK: how big, who pays, what counts
- GDPR data breach: what to do in the first 72 hours
- GDPR cookie consent in the UK: rules after the DUAA 2025
- What is GDPR? A UK guide to the General Data Protection Regulation
Sources & references
- ICO — Annual Report and Financial Statements 2025/26
- ICO — correction to the 2025/26 annual report
- ICO — Annual Report 2020/21, British Airways and Marriott penalties
- ICO — Reddit penalty, February 2026
- ICO — combined Capita penalties
- ICO — TikTok penalty final after appeals withdrawn, September 2026
- Upper Tribunal — ICO v Clearview AI, October 2025
- ICO — Clearview Court of Appeal proceedings, February 2026
- ICO — Advanced Computer Software penalty
- ICO — 23andMe penalty
- ICO — LastPass UK penalty
- ICO — DPP Law penalty
- ICO — Birthlink penalty
- ICO — data protection fining guidance
- ICO — PECR penalty changes from 5 February 2026
- DLA Piper — GDPR fines and data breach survey, January 2026
- ICO — incident trends through Q4 2025
The surest way to stay off the ICO's enforcement list — train your team in UK GDPR and safe data handling.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.