PROFILE
Mandate and constitution
The UK Information Commissioner's Office (ICO) is the independent regulatory authority established under the Data Protection Act 1984 (now superseded by the Data Protection Act 2018). It is responsible for upholding information rights in the public interest, promoting openness by public bodies, and enforcing the Data Protection Act 2018, the UK GDPR, the Privacy and Electronic Communications Regulations 2003 (PECR, the UK implementation of the ePrivacy Directive), the Freedom of Information Act 2000 and several other information-rights statutes. Headquartered in Wilmslow, Cheshire, with regional offices in Edinburgh, Cardiff and Belfast.
Since the UK's departure from the EU, the ICO is no longer an EU supervisory authority and does not participate in EDPB cooperation as a member. The ICO maintains an observer relationship with the EDPB and active bilateral relationships with EU DPAs, particularly the DPC, BfDI, CNIL and Garante. The Information Commissioner (currently John Edwards, in office since January 2022) leads the ICO; the office is accountable to the UK Parliament through the Department for Science, Innovation and Technology.
Fining philosophy
The ICO's sanctioning approach is shaped by the Notice of Intent procedure under the Data Protection Act 2018. Before issuing a final Monetary Penalty Notice, the ICO must serve a Notice of Intent setting out the proposed sanction and the reasons for it. The controller then has a defined period (28 days, extensible by agreement) to make written representations. The ICO must consider those representations before issuing the final notice. This procedure has, in practice, produced substantial reductions between Notice of Intent and final fine for several large cases, notably British Airways (89% reduction) and Marriott (81% reduction).
The Information Commissioner has stated publicly that the ICO favours a proportionate, behaviourally-effective approach to sanctions, with a preference for corrective action over headline fines where corrective action will achieve the regulatory objective. The ICO also makes substantial use of enforcement notices (orders to do or refrain from doing something) and undertakings (voluntary commitments by controllers) as alternatives to fines, particularly for less serious or first-offence matters.
Headline UK decisions
British Airways (£20M, October 2020, reduced from £183.39M): the largest UK GDPR fine, addressing the 2018 customer-data breach affecting 429,000 customers. Article 32 inadequate-security infringement.
Marriott International (£18.4M, October 2020, reduced from £99.2M): the Starwood guest-data breach affecting up to 339 million records globally. Article 32 plus due-diligence-on-acquisition reference case.
TikTok UK (£12.7M, April 2023): for unlawful processing of children's personal data, specifically for failing to obtain parental consent for the processing of personal data of children under 13 who were nonetheless allowed to use the platform. Article 8(1) UK GDPR (lawful basis for child processing).
Clearview AI Inc (£7.5M, May 2022): for collecting and processing UK residents' facial-image data without lawful basis, mirroring the parallel EU decisions from the Garante, CNIL and Greek HDPA. The ICO order included deletion of UK-resident data.
Other notable decisions include the Cabinet Office (£500k, 2021) for publishing New Year Honours list addresses; Tuckers Solicitors (£98k, 2022) for inadequate security leading to ransomware attack; and a steady stream of PECR-direct- marketing enforcement against small UK businesses, often in the £50k-£500k range.
UK reforms and the adequacy question
The UK Government has, since Brexit, periodically proposed reforms to the UK GDPR aimed at reducing administrative burden on UK controllers. The Data Protection and Digital Information Bill (introduced in 2022, revised in 2023, lapsed at the May 2024 general election, reintroduced in revised form in 2025) proposes changes including a relaxed legitimate-interests assessment for some processing, a redefined DPIA framework, and changes to the lawful-basis framework for cookies and similar technologies. The reforms have been the subject of detailed engagement with the European Commission to ensure continued EU adequacy.
The EU adequacy decisions for the UK (one under GDPR, one under the Law Enforcement Directive) were adopted on 28 June 2021 and reviewed in 2025. The 2025 review concluded that adequacy continued to apply, subject to monitoring of UK reforms. Any future UK reform that materially weakens the data-protection framework risks triggering an adequacy challenge or non-renewal at the next review cycle, which would create substantial friction for UK-EU data flows.
Recent enforcement trends
The ICO's 2024-2026 enforcement priorities, set out in its ICO25 strategy and updated annually, include children's data (continuing the TikTok UK line, with the Age Appropriate Design Code as the operative framework), AI systems (including LLM training and inference processing), cookies and adtech, employment monitoring, and political-party data processing in election cycles. The Children's Code (Age Appropriate Design Code), enforceable since September 2021, is a distinctively UK contribution to the field and has been influential globally on child-focused platform design.