- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
The Electoral Commission – Reprimand (United Kingdom, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Electoral Commission was reprimanded after a security breach allowed unauthorized access to personal data of about 40 million individuals. This incident matters because it shows the serious consequences of not having strong security measures in place to protect sensitive information. The reprimand highlights the need for better security practices in organizations handling large amounts of personal data.
What happened
The Electoral Commission experienced a security breach that exposed personal data due to unpatched software vulnerabilities.
Who was affected
Approximately 40 million individuals whose data was part of the Electoral Register were affected by the breach.
What the authority found
The Information Commissioner's Office reprimanded the Electoral Commission for failing to implement adequate security measures to protect personal data.
Why this matters
This reprimand emphasizes the critical need for organizations to maintain strong cybersecurity practices. It serves as a warning that neglecting security can lead to significant data breaches.
Source checks
Secondary-source text retrieved.
Automated check recorded — 16 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately 40,000,000 individuals, and the initial access was gained via several unpatched software vulnerabilities. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for The Electoral Commission in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
9 May 2024
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. The Electoral Commission - United Kingdom (2024). Retrieved from cookiefines.eu
Last updated: