Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Kingdom (UK) · Module Detail

United Kingdom: Enforcement & Redress

← Full United Kingdom overview Build report with United Kingdom Request deeper dive

#

Enforcement powers and recent activity are robust and well evidenced across multiple 2026 cases; collective redress remains constrained by case law, which is a known and stable limitation rather than a gap.

Primary frameworkUK GDPR Articles 83-84 (as implemented via DPA 2018); PECR 2003
Supervisory authorityInformation Commissioner's Office (ICO)
Traffic-light rationale — GreenEnforcement powers and recent activity are robust and well evidenced across multiple 2026 cases; collective redress remains constrained by case law, which is a known and stable limitation rather than a gap.

Sub-modules (6)

Key findings (1)

Category narrative229 words

Under Art. 83 UK GDPR and s.157 DPA 2018, maximum administrative fines are £8.7 million or 2% of total worldwide annual turnover (standard tier) and £17.5 million or 4% of total worldwide annual turnover (higher tier). From 5 February 2026, DUAA 2025 s.115 and Schedule 13 (commenced by SI 2026/82) raise PECR maximum penalties from £500,000 to match the UK GDPR £17.5m / 4% ceiling, while DUAA Part 6 expands ICO investigative powers with compulsory interview notices (s.142A DPA 2018), power to require controller-funded technical reports by approved skilled persons (s.146A DPA 2018), and extended Penalty Notice timelines. Recent landmark enforcement includes the £14.47m fine against Reddit, Inc. (23 February 2026, children's privacy and age assurance), the £23.1m fine against 23andMe (17 June 2025, credential-stuffing breach of genetic data of 155,592 UK residents), the £3.07m processor fine against Advanced Computer Software Group Ltd (March 2025, NHS ransomware breach), and the £1.2m fine against Financial Ombudsman Service (2025/2026). Private redress under Art. 82 UK GDPR and s.168 DPA 2018 permits compensation for material and non-material damage (including distress), while opt-out representative class actions under CPR 19.8 remain constrained by Lloyd v Google LLC [2021] UKSC 50 (requiring individualised assessment of damage and unlawful processing unless bifurcated liability is established) alongside Prismall v Google UK Ltd [2024] EWCA Civ 1326 (confirming the high threshold for misuse of private information class claims).

Sources and claims (11)
  1. ConfirmedInformation Commissioner's Office — Under UK GDPR and the DPA 2018, the ICO can issue fines of up to £17.5 million or 4% of an organisation's annual worldwide turnover, whichever is higher.observed
  2. ConfirmedInformation Commissioner's Office — The DUAA gives the ICO new powers, including the ability to compel witnesses to attend interviews and request technical reports, and raises the PECR maximum fine to £17.5 million or 4% of global turnover.observed
  3. ConfirmedInformation Commissioner's Office — On 23 February 2026, the ICO imposed a £14,472,500 penalty on Reddit, Inc. for infringing UK GDPR Articles 5(1)(a), 6, 8 and 35.observed
  4. ConfirmedInformation Commissioner's Office — On 26 February 2026, the ICO published a £247,590 monetary penalty notice against MediaLab for unlawful processing of children's data on the Imgur platform.observed
  5. ConfirmedInformation Commissioner's Office — On 7 May 2026, the ICO fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 for infringing UK GDPR Articles 5(1)(f) and 32(1) following a cyber incident.observed
  6. ConfirmedInformation Commissioner's Office — On 20 May 2026, the ICO fined KRA Consultancy Ltd £300,000 for breaching PECR regulations 22 and 23 through mass unsolicited marketing texts.observed
  7. ConfirmedIAPP — The DUAA-driven governance reform moves the ICO from a corporation-sole structure to a traditional chair, CEO and board model intended to provide institutional continuity and resilience.observed
  8. ConfirmedDataGuidance — In Lloyd v Google LLC [2021] UKSC 50, the UK Supreme Court held that damages under the (then) Data Protection Act require proof of material damage or distress caused by unlawful processing, not merely the unlawful processing (loss of control) itself, precluding the proposed representative 'class action' claim.observed
  9. ProbableIAPP — Following Lloyd v Google, claimant law firms pursuing UK data-breach mass actions face the requirement that individual class members evidence the damage or distress they personally suffered, constraining opt-out-style collective redress.observed
  10. ConfirmedInformation Commissioner's Office — UK GDPR gives individuals a right to claim compensation from an organisation in court for both material damage (e.g., financial loss) and non-material damage (e.g., distress) suffered from a breach of data protection law, though the ICO cannot itself award compensation.observed
  11. ConfirmedInformation Commissioner's Office — As of 19 June 2026, all data protection provisions of the DUAA 2025 are in force, including a new mandatory requirement for all organisations to have a data protection complaints-handling process in place.observed