Post Office Limited – Reprimand (United Kingdom, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Post Office Limited accidentally published a document online that included personal information about 502 individuals involved in a legal case. The Information Commissioner's Office reprimanded the company for this mistake. This incident highlights the importance of careful document handling and data protection.
What happened
Post Office Limited uploaded an unredacted legal document containing personal data to its website.
Who was affected
The 502 claimants involved in the 2017 group litigation against Post Office Limited were affected by the data exposure.
What the authority found
The Information Commissioner's Office reprimanded Post Office Limited for failing to protect personal data in the published document.
Why this matters
This case underscores the need for organizations to ensure that sensitive documents are properly reviewed before publication. It serves as a warning that careless handling of personal data can lead to serious privacy breaches.
Source checks
Secondary-source text retrieved.
Automated check recorded — 16 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 25 April 2024, Post Office Limited (POL) uploaded an unredacted copy of a legal Settlement Deed to its corporate website instead of the intended redacted version. The Settlement Deed contained the personal data of 502 claimants who were part of the 2017 group litigation brought against POL which exposed the Horizon IT Scandal.
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for Post Office Limited in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
2 December 2025
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. Post Office Limited - United Kingdom (2025). Retrieved from cookiefines.eu
Last updated: