UK GDPR penalties and fines

The UK GDPR fining regime allows the Information Commissioner to impose fines for a wide range of infringements under the UK GDPR and the Data Protection Act 2018. The ICO's fining guidance says there are two levels of maximum fine under Article 83 UK GDPR and section 157 DPA 2018: a standard maximum and a higher maximum.

The decision is not just about whether an infringement happened. The Commissioner must have regard to the factors listed in Article 83(2) UK GDPR when deciding whether to issue a penalty notice and when setting the amount, so the facts, the seriousness of the breach, and the organisation's response all matter.

Ownership should sit with the team that controls the processing purpose, system behavior, vendor terms, transfer mechanism, rights channel, breach process, or child-user journey.

Evidence should show role mapping, lawful basis, Article 9/10 basis where needed, transparency wording, DPIA outcome, DSAR response, breach assessment, transfer mechanism, processor terms, and ICO escalation note.

Most UK GDPR mistakes happen at the boundary between UK GDPR, DPA 2018, PECR, EU GDPR divergence, IDTA/Addendum transfer rules, children data, and processor/subprocessor duties.

Use this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.

Use a UK GDPR workflow that captures role, purpose, lawful basis, special-category status, DPIA trigger, rights/breach/transfer trigger, evidence, owner, and review date.

The output should be a lawful-basis note, DPIA decision, privacy notice update, DSAR record, breach assessment, transfer pack, processor clause map, or ICO response record.