Information Commissioner's Office
Data protection authority of United Kingdom
Total Actions
111
Total Fines
€191.9M
Average Fine
€2.5M
Among actions with fines
Enforcement Factor
2.00
Highly active
About Information Commissioner's Office
The Information Commissioner's Office is United Kingdom's principal data protection regulator and one of Europe's most assertive enforcers of GDPR and ePrivacy rules. Information Commissioner's Office has taken 111 enforcement actions resulting in €191,870,662 in total penalties, with an average fine of €2.5M per sanctioned entity. With an enforcement factor of 2.0, Information Commissioner's Office ranks among Europe's most active GDPR and ePrivacy regulators, pursuing both large technology companies and smaller domestic businesses. Its most significant action was a €23,400,000 fine against British Airways in 2020. Key enforcement areas include cookies placed before consent, third-party cookies without consent, unclear cookie information. The most frequently cited legal basis in Information Commissioner's Office's decisions is Art. 5(1)(f) GDPR and Art. 5(1)(a) GDPR.
Largest Fines by Information Commissioner's Office
View all actionsRecent Actions by Information Commissioner's Office
View all actionsEnforcement by Year
| Year | Actions | Total Fines |
|---|---|---|
| 2019 | 6 | €320K |
| 2020 | 20 | €69.7M |
| 2021 | 25 | €3.5M |
| 2022 | 12 | €17.9M |
| 2023 | 6 | €15.3M |
| 2024 | 14 | €1.5M |
| 2025 | 17 | €46.8M |
| 2026 | 11 | €36.8M |
Most Enforced Violations
Frequently Asked Questions
How many GDPR and ePrivacy actions has Information Commissioner's Office issued?
Information Commissioner's Office has issued 111 enforcement actions related to GDPR and ePrivacy, totaling €191.9M.
What is Information Commissioner's Office's largest GDPR and ePrivacy fine?
The largest was a €23.4M fine against British Airways on 2020-10-16.
What violations does Information Commissioner's Office enforce most?
The most commonly enforced violations by Information Commissioner's Office are cookies placed before consent, third-party cookies without consent, unclear cookie information.