Written question asked by Martin Wrigley (Liberal Democrat) on Friday, 28 August 2026, in the House of Commons. It was due for an answer on Wednesday, 2 September 2026. It was answered by Stephanie Peacock (Labour) on Tuesday, 8 September 2026 on behalf of the Department for Digital, Culture, Media and Sport.

Data Protection: Enforcement

Question: To ask the Secretary of State for Digital, Culture, Media and Sport, what enforcement action has been taken against organisations with inadequate data security since July 2024.

Answer: The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the UK's data protection legislation independently of Government. The ICO has a range of powers to address organisations’ failures to comply with their data protection obligations, including where they have failed to implement appropriate security measures to protect personal data. These powers include enforcement notices, civil monetary penalties and, in certain circumstances, powers of prosecution. Information about enforcement action taken by the ICO since July 2024 is published on the ICO’s website (https://ico.org.uk/action-weve-taken/complaints-and-concerns-data-sets/) .

Secondary information