How UK ICO enforcement works

The enforcement tools

The ICO enforcement register can be filtered by type, sector and date ¹. The ICO Regulatory Action Policy describes the tools behind those entries ².

• Information notice: a formal demand for information to help an investigation ².
• Assessment notice: lets the ICO check compliance, which may include access to premises and documents ².
• Enforcement notice: requires specific action or stops processing, with timescales and appeal details ².
• Penalty notice: a fine, which the policy says is reserved for the most serious cases ².
• Reprimand: issued for infringements of data protection law ².
• Warning: issued where proposed processing threatens non-compliance ².
• Prosecution: for criminal offences, under a separate prosecution policy ².

From notice of intent to penalty

A notice of intent sets out the ICO's findings and the proposed amount before any fine ². The organisation gets at least 21 calendar days to make written representations ². Oral hearings are at the ICO's discretion and limited to exceptional cases ².

The final amount can differ from the provisional one. The Capita case shows the stages ⁴.

How the ICO sets a fine

The ICO's Data Protection Fining Guidance uses five steps ⁶. They are seriousness, turnover, the starting point, aggravating and mitigating factors, and a check that the fine is effective, proportionate and dissuasive ⁶. The ICO says the approach is not intended to be mechanistic ⁷. In exceptional circumstances it may reduce a fine where the organisation cannot pay ⁷.

The ICO prints its top turnover band in two ways. Both tables on the Step 3 page show "Above £435 million". The footnote to the higher maximum table says "Above £437.5 million" ⁹.

The legal maximums

The standard maximum is £8.7 million or, for an undertaking, 2% of total worldwide annual turnover in the preceding financial year, whichever is higher ³. The higher maximum is £17.5 million or 4% ³. The higher maximum covers the infringements in Article 83(5) of the UK GDPR ³.

Case example: Capita, October 2025

On 15 October 2025 the ICO fined Capita plc £8 million and Capita Pension Solutions Limited £6 million, a total of £14 million ⁴. The ICO said 6.6 million people were affected by an attack that began in March 2023 ⁴.

The ICO had notified a provisional intention to fine £45 million ⁴. It reduced the amount after representations, citing improvements after the attack, support for affected people and work with other regulators and the NCSC ⁴. The ICO said Capita admitted liability and agreed to pay without appealing, in a voluntary settlement ⁴.