EU Regulation 2016/679 - Decision Register

ICO REGISTER / SECTOR/GENERAL BUSINESS

ICO enforcement: General business

Every action the Information Commissioner filed under General business on the enforcement register, as it stood on 4 September 2026.

20

Actions in this sector

9% of the register

4 of 20

Rank by volume

sectors on the register

9

Monetary penalties

8 with a published figure

£5,990,000

Penalties published

largest: Advanced Computer Software Group Limited

2022 to 2026

Span on the register

5 years

What the register shows for this sector

General business accounts for 20 of the 216 actions on the register (9%), which makes it the 4th most heavily represented of the 20 sectors the ICO uses. The commonest action here is the monetary penalty, at 9 of 20 (45%). Most actions here name PECR 2003 (12 of 20). 12 were taken under PECR, the marketing and electronic-communications rules, which are counted separately from the UK GDPR throughout this register. 4 organisations appear more than once: Elderly Aids Limited (2), TMAC Ltd (2), Darian Bishop trading as ECO4U (2), Argentum Data Solutions Ltd (2).

01Largest penalties in General business

Ranked by the amount the ICO published
#OrganisationDateActionLawPenalty
1Advanced Computer Software Group Limited26 Mar 2025Monetary penaltyNot stated£3,070,000
223andMe5 Jun 2025Monetary penaltyUK GDPR£2,310,000
3Elderly Aids Limited6 Aug 2026Monetary penaltyPECR 2003£190,000
4Money Bubble Ltd MPN12 Dec 2024Monetary penaltyPECR 2003£120,000
5TMAC Ltd3 Feb 2026Monetary penaltyPECR 2003£100,000
6AFK Letters Co Ltd27 Mar 2025Monetary penaltyPECR 2003£90,000
7DPP Law Ltd14 Apr 2025Monetary penaltyUK GDPR£60,000
8Darian Bishop trading as ECO4U24 Apr 2025Monetary penaltyPECR 2003£50,000

By action type

  • Monetary penalty9 (45%)
  • Enforcement notice6 (30%)
  • Reprimand5 (25%)

By law

By year

02Every General business action

20 entries, newest first. 17 carry a page here.
OrganisationDateActionLawPenalty
Elderly Aids Limited6 Aug 2026Monetary penaltyPECR 2003£190,000
Elderly Aids Limited6 Aug 2026Enforcement noticePECR 2003-
SA Assistance Ltd21 Apr 2026Enforcement noticePECR 2003-
TMAC Ltd3 Feb 2026Monetary penaltyPECR 2003£100,000
TMAC Ltd3 Feb 2026Enforcement noticePECR 2003-
23andMe5 Jun 2025Monetary penaltyUK GDPR£2,310,000
Darian Bishop trading as ECO4U24 Apr 2025Monetary penaltyPECR 2003£50,000
Darian Bishop trading as ECO4U24 Apr 2025Enforcement noticePECR 2003-
DPP Law Ltd14 Apr 2025Monetary penaltyUK GDPR£60,000
AFK Letters Co Ltd27 Mar 2025Monetary penaltyPECR 2003£90,000
Advanced Computer Software Group Limited26 Mar 2025Monetary penaltyNot stated£3,070,000
Money Bubble Ltd EN12 Dec 2024Enforcement noticePECR 2003-
Money Bubble Ltd MPN12 Dec 2024Monetary penaltyPECR 2003£120,000
GRS (Roadstone) Limited14 Nov 2023ReprimandUK GDPR-
Argentum Data Solutions Ltd26 Oct 2023Enforcement noticePECR 2003-
Argentum Data Solutions Ltd26 Oct 2023Monetary penaltyPECR 2003-
Gap Personnel Holdings Limited19 Oct 2023ReprimandUK GDPR-
Recruitment company reprimand9 Aug 2023ReprimandUK GDPR-
Power Leisure Bookmakers Limited6 Dec 2022ReprimandUK GDPR-
Direct Clothing Co. (UK) Limited18 Jul 2022ReprimandUK GDPR-

03Other sectors

Sector not stated

35

actions, £14,820,000 in penalties

Marketing

28

actions, £1,180,000 in penalties

Criminal justice

26

actions, £816,000 in penalties

General business

20

actions, £5,990,000 in penalties

Local government

20

actions

Finance, insurance and credit

19

actions, £410,000 in penalties

Health

15

actions

Central government

14

actions, £350,000 in penalties

Utilities

11

actions, £1,243,900 in penalties

Online technology and telecoms

7

actions, £28,648,373 in penalties

Retail and manufacture

5

actions, £140,000 in penalties

Charitable and voluntary

4

actions, £25,500 in penalties

Education and childcare

3

actions

Legal

2

actions

Transport and leisure

2

actions

Land or property services

1

action

Media

1

action

Political

1

action

Regulators

1

action

Social care

1

action

04Sector analysis elsewhere on the site

GDPR fines by industry

Which sectors draw the largest fines across the EEA and the UK, and the violations that drive them.

Violation types

Consent, security, transparency and transfers: what regulators actually penalise.

The full ICO register

All 216 published ICO enforcement actions, by year, sector and law.

Provenance and independence

Source: ICO enforcement register (ico.org.uk/action-weve-taken/enforcement/), as published on 4 September 2026. Contains public sector information licensed under the Open Government Licence v3.0.

GDPRFine.com is an independent tracker of ICO enforcement. It is not affiliated with, endorsed by or connected to the Information Commissioner's Office, and it uses no ICO branding. Where the ICO's own wording is reproduced it is quoted and attributed; everything else on these pages is our own summary of the published record.

The ICO's register held 222 entries on that date. 6 of them are prosecutions of named individuals, with ages and home towns in the ICO's own summary. This tracker indexes organisations, so those 6 are excluded and every count on these pages is out of 216. They remain on the ICO's own register.

An entry says what the Commissioner did on the date shown. It is not a statement about the organisation today, and the ICO can amend or remove a register entry at any time. Amounts and provisions are as published by the ICO; where the published notice does not state a figure or name a provision, these pages say so rather than filling the gap.

Register: ico.org.uk/action-weve-taken/enforcement/. Corrections: [email protected].

REGISTER UPDATED 2026-04-28