None

Financial penalty

Enforcement notice, no fine

23 September 2026

Date on the register

Data Protection Act 2018

Law relied on

DPA 2018 section 35

Criminal justice

Sector

30 actions on the register

In one line

The ICO issued Metropolitan Police Service with a enforcement notice on 23 September 2026 under the Data Protection Act 2018. No financial penalty attaches to it.

01The record

Organisation named: Metropolitan Police Service
Action: Enforcement notice
Date published: 23 September 2026
Register year: 2026
Law relied on: Data Protection Act 2018
Provisions cited: DPA 2018 section 35
Penalty: None (not a financial penalty)
Sector on the register: Criminal justice
ICO register reference: 126544
Register status: Published on the ICO enforcement register, 19 October 2026
Notice documents: 3 PDFs published by the ICO
Sector share of register: 30 of 220 actions (14%)
Actions published that year: 25
Actions under this law: 10
Position on the register: 219th of 220, oldest first
Published the same day: This entry alone
Entries for this organisation: 3 on this register

02What happened, and where it sits

Metropolitan Police Service received an ICO enforcement notice on 23 September 2026. The Commissioner acted under the Data Protection Act 2018, citing DPA 2018 section 35. An order to act. An enforcement notice requires the organisation to take, or stop taking, specified steps by a deadline, and failure to comply is itself an offence.

No sum is attached to this action. Enforcement notices are corrective, not financial, which is why Metropolitan Police Service appears on the register without a figure beside it.

Metropolitan Police Service is filed under Criminal justice, which accounts for 30 of the 220 actions on the register (14%). In 2026 the ICO published 25 enforcement actions in total, 9 of them enforcement notices. 10 actions on the register name Data Protection Act 2018.

Counted from the oldest entry forward, this is the 219th of 220 actions on the register and the 29th of 30 in Criminal justice. Metropolitan Police Service appears 3 times on this register: reprimand on 2 March 2023, enforcement notice on 23 September 2026 and reprimand on 23 September 2026. The ICO publishes 3 documents for this action, 346 KB in total: "Metropolitan Police Service reprimand and enforcement notice", "Metropolitan Police Service reprimand" and "ICO takes action against Metropolitan Police Service over information governance failures". They are the authority for everything on this page.

03The ICO's own account

The Information Commission has issued a combined Reprimand and Enforcement Notice to the Metropolitan Police Service following findings of infringement of sections 35(1), 40 and 64(1) of the Data Protection Act 2018 relating to the unauthorised use of a third-party platforms to share personal information relating to individuals suspected of shoplifting offences.

Quoted from the ICO's published register entry (ico.org.uk), Open Government Licence v3.0.

The law behind this action

Data Protection Act 2018

The Data Protection Act 2018 carries the UK GDPR into domestic law, sets out the separate law-enforcement and intelligence-services regimes in Parts 3 and 4, and creates the criminal offences the ICO prosecutes.

All 10 register actions under Data Protection Act 2018

What a enforcement notice does

An order to act. An enforcement notice requires the organisation to take, or stop taking, specified steps by a deadline, and failure to comply is itself an offence.

Published notice

04Other entries for Metropolitan Police Service

2 further entries on the register
Organisation	Date	Action	Law	Penalty	Sector
Metropolitan Police Service	23 Sep 2026	Reprimand	Data Protection Act 2018	-	Criminal justice
Metropolitan Police Service	2 Mar 2023	Reprimand	UK GDPR	-	Criminal justice

05Nearest entries on the register

Closest by sector, law and date
Organisation	Date	Action	Law	Penalty	Sector
Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS)	27 Jul 2026	Enforcement notice	Data Protection Act 2018	-	Criminal justice
Crown Prosecution Service	18 Jan 2024	Enforcement notice	Data Protection Act 2018	-	Criminal justice
Metropolitan Police Service	23 Sep 2026	Reprimand	Data Protection Act 2018	-	Criminal justice
Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS)	27 Jul 2026	Reprimand	Data Protection Act 2018	-	Criminal justice
South Wales Police	26 Aug 2022	Reprimand	Data Protection Act 2018	-	Criminal justice

All Criminal justice actions/All 2026 actions/The full register

06Work out an exposure of your own

Article 83 fine calculator

Estimate upper and lower tier exposure from turnover and infringement type, on the same scale the ICO works to.

How a fine is calculated

The Article 83(2) factors, the turnover caps, and how a regulator gets from a contravention to a number.

The ICO profile

How the UK regulator works post-Brexit, the £17.5M and £8.7M UK GDPR caps, and its divergence from the EU regime.

Provenance and independence

Source: ICO enforcement register (ico.org.uk/action-weve-taken/enforcement/), as published on 19 October 2026. Contains public sector information licensed under the Open Government Licence v3.0.

GDPRFine.com is an independent tracker of ICO enforcement. It is not affiliated with, endorsed by or connected to the Information Commissioner's Office, and it uses no ICO branding. Where the ICO's own wording is reproduced it is quoted and attributed; everything else on these pages is our own summary of the published record.

The ICO's register held 226 entries on that date. 6 of them are prosecutions of named individuals, with ages and home towns in the ICO's own summary. This tracker indexes organisations, so those 6 are excluded and every count on these pages is out of 220. They remain on the ICO's own register.

An entry says what the Commissioner did on the date shown. It is not a statement about the organisation today, and the ICO can amend or remove a register entry at any time. Amounts and provisions are as published by the ICO; where the published notice does not state a figure or name a provision, these pages say so rather than filling the gap. This entry was read from the register page at https://ico.org.uk/action-weve-taken/enforcement/2026/09/metropolitan-police-service/.