- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
The Commissioner of Police for the City of London – Violation Found (United Kingdom, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Commissioner of Police for the City of London received complaints about not responding to requests for personal data access. An investigation showed that they failed to reply to less than half of these requests on time. This matters because timely responses are crucial for individuals wanting to know how their data is used.
What happened
The Commissioner of Police for the City of London failed to respond to less than half of subject access requests within the required time frame.
Who was affected
Individuals who submitted subject access requests to the Commissioner of Police for the City of London.
What the authority found
The Information Commissioner's Office found that the Commissioner infringed UK GDPR by not responding to access requests on time.
Why this matters
This case highlights the importance of timely responses to data access requests. Organizations must ensure they have processes in place to comply with these legal requirements.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Commissioner of Police for the City of London (the controller) is responsible for law enforcement within the City of London, receiving subject access requests (SARs) falling under Part 3 DPA 2018 for law enforcement processing, as well as some SARs under the UK GDPR for non-law enforcement processing, such as employees’ SARs in HR matters. Several data subjects lodged complaints with the DPA regarding SAR compliance between 2023 and 2025. Subsequently, the DPA launched an investigation into the controller's compliance with SARs. The DPA found that between 1 April 2023 and 31 March 2024, less than half of the SARs submitted had received a response within the statutory time frame. However, the DPA noted that the controller’s compliance with SARs improved to 93% for the period of April 2025 to July 2025. Therefore, the DPA held that between 1 April 2023 and 31 July 2025, the controller infringed Article 12(3) UK GDPR and S45(3) DPA 2018 by failing to respond to subjects’ access requests within the statutory time frame and issued a reprimand along with a recommendation for bringing its activities into compliance.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for The Commissioner of Police for the City of London in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
20 February 2026
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. The Commissioner of Police for the City of London - United Kingdom (2026). Retrieved from cookiefines.eu
Last updated: