---
title: "United Kingdom — Enforcement & Redress | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/enforcement-and-redress/
source_html: /jurisdictions/united-kingdom/enforcement-and-redress/index.html
description: "United Kingdom — Enforcement & Redress (Green, 6 sub-modules, 11 claims): Enforcement powers and recent activity are robust and well evidenced across multiple 2026 cases; collective redress remains constrained by case law, which is a known"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 0ae2acb12ad415985f17b8a1b021c49fc112c5f2b6482fb1738da9fd09a4049d
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Enforcement & Redress | Data Protection Monitor

### D10Enforcement & Redress6 sub-modules11 claimsGreen▾#

Enforcement powers and recent activity are robust and well evidenced across multiple 2026 cases; collective redress remains constrained by case law, which is a known and stable limitation rather than a gap.

Primary framework UK GDPR Articles 83-84 (as implemented via DPA 2018); PECR 2003

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Green Enforcement powers and recent activity are robust and well evidenced across multiple 2026 cases; collective redress remains constrained by case law, which is a known and stable limitation rather than a gap.

#### Sub-modules (6)

#### Key findings (1)

- Four major ICO enforcement actions in 2026 totalling ~£16m. — [Imgur owner MediaLab fined over children's privacy failures](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/imgur-owner-medialab-fined-over-children-s-privacy-failures/)

Category narrative 229 words

Under Art. 83 UK GDPR and s.157 DPA 2018, maximum administrative fines are £8.7 million or 2% of total worldwide annual turnover (standard tier) and £17.5 million or 4% of total worldwide annual turnover (higher tier). From 5 February 2026, DUAA 2025 s.115 and Schedule 13 (commenced by SI 2026/82) raise PECR maximum penalties from £500,000 to match the UK GDPR £17.5m / 4% ceiling, while DUAA Part 6 expands ICO investigative powers with compulsory interview notices (s.142A DPA 2018), power to require controller-funded technical reports by approved skilled persons (s.146A DPA 2018), and extended Penalty Notice timelines. Recent landmark enforcement includes the £14.47m fine against Reddit, Inc. (23 February 2026, children's privacy and age assurance), the £23.1m fine against 23andMe (17 June 2025, credential-stuffing breach of genetic data of 155,592 UK residents), the £3.07m processor fine against Advanced Computer Software Group Ltd (March 2025, NHS ransomware breach), and the £1.2m fine against Financial Ombudsman Service (2025/2026). Private redress under Art. 82 UK GDPR and s.168 DPA 2018 permits compensation for material and non-material damage (including distress), while opt-out representative class actions under CPR 19.8 remain constrained by Lloyd v Google LLC [2021] UKSC 50 (requiring individualised assessment of damage and unlawful processing unless bifurcated liability is established) alongside Prismall v Google UK Ltd [2024] EWCA Civ 1326 (confirming the high threshold for misuse of private information class claims).

Evidence 11

Sources and claims (11)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/) — Under UK GDPR and the DPA 2018, the ICO can issue fines of up to £17.5 million or 4% of an organisation's annual worldwide turnover, whichever is higher.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/uk-organisations-stand-to-benefit-from-new-data-protection-laws/) — The DUAA gives the ICO new powers, including the ability to compel witnesses to attend interviews and request technical reports, and raises the PECR maximum fine to £17.5 million or 4% of global turnover.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/action-weve-taken/enforcement/2026/02/reddit-inc/) — On 23 February 2026, the ICO imposed a £14,472,500 penalty on Reddit, Inc. for infringing UK GDPR Articles 5(1)(a), 6, 8 and 35.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/imgur-owner-medialab-fined-over-children-s-privacy-failures/) — On 26 February 2026, the ICO published a £247,590 monetary penalty notice against MediaLab for unlawful processing of children's data on the Imgur platform.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/action-weve-taken/enforcement/2026/05/south-staffordshire-plc-and-south-staffordshire-water-plc/) — On 7 May 2026, the ICO fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 for infringing UK GDPR Articles 5(1)(f) and 32(1) following a cyber incident.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/action-weve-taken/enforcement/2026/05/kra-consultancy-ltd-mpn/) — On 20 May 2026, the ICO fined KRA Consultancy Ltd £300,000 for breaching PECR regulations 22 and 23 through mass unsolicited marketing texts.observed 2026-07-28
- Confirmed[IAPP](https://iapp.org/news/a/ico-ceo-paul-arnold-on-what-s-ahead-for-the-agency-s-reforms) — The DUAA-driven governance reform moves the ICO from a corporation-sole structure to a traditional chair, CEO and board model intended to provide institutional continuity and resilience.observed 2026-07-28
- Confirmed[DataGuidance](https://www.dataguidance.com/news/uk-supreme-court-overturns-court-appeal-judgment-lloyd) — In Lloyd v Google LLC [2021] UKSC 50, the UK Supreme Court held that damages under the (then) Data Protection Act require proof of material damage or distress caused by unlawful processing, not merely the unlawful processing (loss of control) itself, precluding the proposed representative 'class action' claim.observed 2026-07-28
- Probable[IAPP](https://iapp.org/news/a/uk-supreme-court-halts-billion-dollar-privacy-class-action-against-google) — Following Lloyd v Google, claimant law firms pursuing UK data-breach mass actions face the requirement that individual class members evidence the damage or distress they personally suffered, constraining opt-out-style collective redress.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/) — UK GDPR gives individuals a right to claim compensation from an organisation in court for both material damage (e.g., financial loss) and non-material damage (e.g., distress) suffered from a breach of data protection law, though the ICO cannot itself award compensation.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/one-month-to-go-what-businesses-need-to-know-to-meet-new-data-law/) — As of 19 June 2026, all data protection provisions of the DUAA 2025 are in force, including a new mandatory requirement for all organisations to have a data protection complaints-handling process in place.observed 2026-07-28