The Information Commissioner’s Office has published new data protection fining guidance setting out how it decides to issue penalties and calculate fines.

The guidance provides greater transparency for organisations about how the ICO goes about using its fining power.

Publication of the guidance follows a consultation last year, where views were gathered on a draft version.

The new guidance replaces the sections about penalty notices in the ICO Regulatory Action Policy published in November 2018.

Among other things, the guidance explains the legal framework that gives the ICO the power to impose fines – helping people more easily navigate the complexity of the legislation.

Furthermore, the new guidlines reveal how the ICO will approach key questions, such as identifying the wider ‘undertaking’ or economic entity of which the controller or processor forms part; and the methodology the ICO will use to calculate the appropriate amount of the fine.

Recommended reading

• ICO Launches Public Survey Amid Care Data Access Concerns
• Meta Introduces New Data Sharing Choices to Comply with DMA
• ICO Reprimands NHS Lanarkshire Staff for WhatsApp Data Sharing

Tim Capel, ICO director of legal service, said: “We believe the guidance will provide certainty and clarity for organisations.

“It shows how we reach one of our most important decisions as a regulator by explaining when, how and why we would issue a fine for a breach of the UK General Data Protection Regulation or Data Protection Act 2018.”

How Much Did the ICO Fine Businesses in 2023?

In 2023, the Information Commissioner’s Office (ICO) ordered 18 businesses to pay more than £14.3 million in fines for misusing data, according to analysis by cybersecurity and data protection consultancy CSS Assure.

The ICO also reprimanded 36 companies, issued enforcement notices against a further 19, and prosecuted four businesses for failing to meet their information rights obligations.

At £12.7 million, social media platform TikTok was hit with the largest fine for breaching data protection law, including failing to use children’s personal data lawfully – with the ICO estimating that up to 1.4 million under 13s in the UK were able to use the video sharing app in 2020.