ICO Enforcement in 2025: What Changed and Why It Matters

In the first half of 2025, the Information Commissioner's Office issued six fines totalling approximately £5.6 million in comparison to the whole of 2024, when it issued eighteen fines totalling £2.7 million. The arithmetic is stark: fewer enforcement actions, but the average penalty has more than doubled.

This is not a coincidence by the way, it reflects a deliberate shift in the ICO's enforcement approach and one that has significant implications for charities and not for profits that have assumed a degree of regulatory protection by virtue of their sector or their size.

What Changed in 2025

The Data (Use and Access) Act became law

The DUAA received Royal Assent on 19 June 2025 and represented the most significant change to the UK data protection landscape since GDPR. Its practical effects include: a new recognised legitimate interest lawful basis for specific processing activities; new requirements for organisations to establish data protection complaints processes; expanded ICO investigatory and enforcement powers; and a requirement for the ICO to commission third-party expert reviews at the controller's expense as part of certain investigations.

That last point is worth dwelling on - the ICO can now require an organisation to pay for an independent expert to examine its data protection arrangements. This is a power the Financial Conduct Authority has long used against regulated firms and its extension to data protection enforcement significantly raises the potential cost of being investigated.

The ICO's Ripple Effect campaign

Launched in 2024 and continuing through 2025, the ICO's Ripple Effect campaign shifted the public framing of data protection enforcement. Rather than presenting breaches primarily as regulatory violations, the campaign focused on their human consequences such as the real people affected by lost data, mishandled information, and governance failures. The Birthlink case, in which the ICO fined a charity £18,000 for destroying irreplaceable adoption records, was emblematic of this framing.

This matters for how the ICO communicates its decisions. Fines are now routinely accompanied by detailed case studies that describe the impact on individuals and the reputational consequence of enforcement action has become more significant than the financial penalty in many cases.

The public sector approach and charities

Since March 2024, the ICO has applied a lighter touch to public sector organisations, preferring reprimands over fines where possible, and calibrating penalties against administrative budgets rather than total income when fines are imposed. Charities have benefited from an approach that the ICO has described as being in the spirit of its public sector policy.

But the Birthlink case demonstrates the limits of that protection and the ICO concluded that a fine was appropriate despite Birthlink's charitable status, not just because of the seriousness of the breach but the absence of even basic policies and procedures. The lighter touch is not immunity, it is a calibration and it clearly does not apply where the ICO determines that the failures are sufficiently serious or that too few reasonable steps were taken.

What the Enforcement Record Shows About Where Risk Sits

Looking at ICO enforcement actions against charities over the past three years, a pattern emerges. The cases that result in fines or public reprimands are not typically the result of sophisticated data processing failures. They are the result of basic governance gaps:

• No documented policies or procedures.

• Inadequate staff training.

• Poor records management.

• Failure to report breaches within the 72-hour window.

• Insufficient oversight of third-party data processors.

These are not technical failures. They are governance failures, the kind that a board can address without specialist technical expertise, but that require deliberate attention and documented action.

What 2026 Is Likely to Bring

The trajectory of ICO enforcement suggests three things for the year ahead.

First, the DUAA's new investigatory powers will bed in and whilst the ability to commission third-party expert reviews at an organisation's expense is likely to be used selectively initially, its existence changes the calculation for any organisation under investigation. Being the subject of an ICO investigation has become more costly overnight not just reputationally but financially.

Second, AI governance will come into sharper focus. The ICO has published guidance on AI and data protection, and there is an expectation in that guidance that organisations using AI tools are applying the same data protection standards to those tools as to any other processing arrangement. The sector's rapid AI adoption, combined with the governance gap most charities have in this area, creates material risk.

Third, the volume of Subject Access Requests will continue to rise. The ICO received over 15,300 complaints in a single year about organisations failing to handle SARs properly. For organisations that hold data across multiple systems such as spreadsheets, CRMs, email archives, paper records responding to a SAR within the one-month legal deadline is a significant operational challenge without the right systems and processes in place.

The Practical Implication

The 2025 enforcement picture is not designed to alarm, it is designed to inform. The organisations that face enforcement action are, with few exceptions, organisations that have not done the basic work such as documentation, the training, the policies and board oversight that data protection law has required since 2018.

That work is not complex and it is not expensive. For most charities, it takes weeks rather than months to get the foundations in place but it does require a decision to treat data protection as a governance priority rather than an operational afterthought.

The ICO has said that cost-effective, easy-to-implement policies and procedures would have prevented the Birthlink breach. That is not a critique of charities that have not yet built those foundations. It is an observation about how achievable the baseline actually is and how much protection it provides.