Fines and enforcement
What a regulator reprimand means
Short answer
- Legal basis in the EU
- GDPR corrective power, recital 148 1
- Money penalty
- None in the reprimand itself 1
- UK reprimands, June 2022 to June 2024
- About 77, with 60 to public sector bodies 2
- UK appeal route
- No statutory appeal to the Tribunal, judicial review possible 2
- Irish DPC 2025 final decisions with a reprimand
- 7 listed in the annual report 4
Reprimand compared with other outcomes
- Reprimand: a formal finding that the law was broken, published or recorded, with no money penalty attached. The GDPR says a reprimand may be issued instead of a fine in some cases 1.
- Fine: a money penalty. The GDPR says fines can be imposed in addition to, or instead of, other measures 1.
- Order or injunction: a direction to change processing by a deadline. The DPC ordered the HSE to audit storage sites and destroy records it no longer needed 5. The CNIL issues injunctions, sometimes with a reprimand and no fine 7.
- Enforcement or compliance notice: used outside the EU. South Africa's Information Regulator ordered nine actions within 31 days in a 2023 enforcement notice and imposed no fine 9. New Zealand's Privacy Commissioner issued compliance notices with deadlines in 2027 8.
United Kingdom: the public sector approach
In June 2022 the ICO began a two-year trial of a revised approach to public bodies. It used its discretion to reduce the impact of fines on the public sector and paired this with more engagement, including published lessons learned 2.
The ICO's review, published in September 2024, counted about 77 reprimands during the trial. Its section 5.2 says 60 went to public sector organisations, and its executive summary puts the public sector share at 80%. Reprimands rose 54% on the previous two years. Four monetary penalty notices to public bodies totalled £1.2 million. The ICO estimated that fines could have reached £23.2 million without the approach 2.
The review notes that an organisation can make representations on a notice of intent to issue a reprimand. It says there is no statutory right of appeal to the Tribunal, though judicial review is possible 2.
In December 2024 the ICO said it would continue the approach with clearer parameters and consult until the end of January 2025, as reported by Sam Trendall in Civil Service World 3.
Ireland: reprimands with fines and orders
The DPC often combines a reprimand with other measures. Its 2025 annual report lists seven final decisions that included a reprimand, among them decisions on the Department of Social Protection, Microsoft Ireland Operations Limited and the University of Limerick 4.
In the HSE decision announced on 2 September 2026, the DPC imposed fines totalling €645,000, a reprimand and orders on paper record storage 5. In the WhatsApp decision of 2 September 2021 it imposed a €225 million fine, a reprimand and an order to bring processing into compliance 6.
France: reprimands in the CNIL sanctions list
Common questions
Is a reprimand a fine?
No. A reprimand is a formal finding of a breach with no money penalty attached. The GDPR allows a reprimand instead of a fine for a minor infringement 1.
Can a reprimand be appealed in the UK?
The ICO's 2024 review says there is no statutory right of appeal to the Tribunal against a reprimand, though judicial review is possible. Organisations can make representations on a notice of intent 2.
Can a regulator issue a reprimand and a fine together?
Yes. Ireland's DPC fined the HSE €645,000 and reprimanded it in 2026 5. The CNIL fined a municipality €10,000 with a reprimand in September 2025 7.
Why does the ICO reprimand public bodies instead of fining them?
Under its public sector approach, begun in June 2022, the ICO used its discretion to reduce the impact of fines on public bodies and paired this with more engagement and published lessons learned. Reprimands rose 54% on the previous two years 2.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- Information Commissioner's Office: Post-implementation review, Public sector approach trial (September 2024)
- Civil Service World, Sam Trendall: ICO to continue 'minimal-fine regime' for public-sector bodies (13 December 2024)
- Data Protection Commission: Annual Report 2025 (undated)
- Data Protection Commission: Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) (2 September 2026)
- Data Protection Commission: Data Protection Commission announces decision in WhatsApp inquiry (2 September 2021)
- CNIL: Les sanctions prononcées par la CNIL (14 April 2026)
- Office of the Privacy Commissioner: Privacy Commissioner issues Compliance Notices to Manage My Health and Health NZ (23 September 2026)
- Information Regulator: Enforcement Notice, Department of Justice and Constitutional Development (9 May 2023)
Related
- How UK ICO enforcement works
The UK ICO's enforcement tools, how its fines are calculated under the 2024 fining guidance, the statutory maximums and the Capita case.
- How GDPR fines are calculated
The GDPR fine ceilings, the Article 83 factors and the EDPB five-step method, with seriousness levels, turnover bands and real decisions.
- Data protection fines reduced or cancelled on appeal
Court rulings that cut, cancelled or upheld privacy fines in Germany, France, Luxembourg, Italy, Ireland, the UK and South Korea, with dates.
- EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.
- Data protection regulators in Africa
Enforcement notices, infringement notices, penalty notices and annual figures from South Africa's Information Regulator, Kenya's ODPC and Nigeria's NDPC.