Organizations that breach UK data protection law can be fined up to £17.5 million or 4% of global annual turnover, whichever is higher. That is the ceiling for the most serious violations of the UK GDPR. Less serious, mostly administrative failures sit under a lower ceiling of £8.7 million or 2% of global turnover. GDPR fines in the UK are issued by the Information Commissioner’s Office (ICO) under the UK GDPR and the Data Protection Act 2018, and the final number in any given case comes out of a structured calculation, not a fixed schedule.
The Two Fine Tiers and What They Cover
Every UK GDPR violation falls into one of two tiers, and the tier decides the maximum.
The standard tier caps fines at £8.7 million or 2% of worldwide annual turnover from the preceding financial year, whichever is higher. It covers the administrative and procedural obligations in Articles 8, 11, and 25 through 39 of the UK GDPR: keeping records of processing activities, running a data protection impact assessment before high-risk processing, appointing a data protection officer when required, having proper contracts with processors, and reporting breaches on time. Failures involving certification bodies under Articles 42 and 43 sit here too.1Legislation.gov.uk. UK GDPR Article 83 – General Conditions for Imposing Administrative Fines
The higher tier caps fines at £17.5 million or 4% of worldwide annual turnover, whichever is higher. It applies to breaches of the core processing principles in Articles 5, 6, 7, and 9 (lawfulness, fairness, transparency, purpose limitation, and the handling of special-category data like health and biometrics), breaches of individuals’ rights under Articles 12 to 21, unlawful international data transfers, and any refusal to comply with a direct ICO order.1Legislation.gov.uk. UK GDPR Article 83 – General Conditions for Imposing Administrative Fines
The “whichever is higher” rule is what makes the turnover percentage matter. A company with £1 billion in global revenue has a theoretical top-tier exposure of £40 million, well above the £17.5 million fixed cap. For smaller organizations, the fixed amounts are the effective ceiling.2Information Commissioner’s Office. The Maximum Amount of a Fine Under UK GDPR and DPA 2018
Turnover means revenue from goods and services, after trade discounts, VAT, and other relevant taxes. The ICO works from consolidated audited accounts for the year before the penalty notice, or from unaudited figures where the organization is exempt from audit.3Information Commissioner’s Office. Step 2 – Accounting for Turnover
How the ICO Calculates a Fine
The ICO uses a five-step process rather than picking a figure straight from the caps.4Information Commissioner’s Office. Calculation of the Appropriate Amount of the Fine
- Step 1: assess the seriousness of the infringement.
- Step 2: account for the organization’s turnover, where it qualifies as an undertaking.
- Step 3: set a starting point based on seriousness and turnover.
- Step 4: adjust for aggravating and mitigating factors.
- Step 5: check that the result is effective, proportionate, and dissuasive.
The factors feeding into steps 1 and 4 come from Article 83(2) of the UK GDPR and Section 155(3) of the Data Protection Act 2018. They include the nature, gravity, and duration of the breach; whether it was intentional or negligent; what the organization did once it found out; the sensitivity of the data; whether the organization self-reported; any prior violations; and the level of cooperation with the investigation.5Legislation.gov.uk. Data Protection Act 2018 – Section 155 Penalty Notices
The ICO also looks at any financial benefit the organization got from the breach, directly or indirectly. If skimping on data protection saved money, the fine is meant to at least cancel out the saving. The ICO describes the exercise as one of “evaluation and judgement” across all the circumstances, not a formula.4Information Commissioner’s Office. Calculation of the Appropriate Amount of the Fine
Fines are also not the only tool. The ICO can issue warnings, reprimands, and enforcement notices requiring specific fixes, order data to be erased or corrected, ban certain processing, and suspend international data transfers. Since 2022 it has published every reprimand it issues, naming the organization. For many bodies, that public record does as much damage as a fine.6Information Commissioner’s Office. Circumstances in Which the Commissioner Would Consider It Appropriate to Issue a Penalty Notice
What Proposed Fines Actually Become
Headline proposed fines and final fines often diverge sharply, because the calculation runs before the organization has made its case.
- British Airways (2020): £20 million final, for a 2018 breach exposing personal and financial details of around 400,000 customers. The ICO’s original proposal was £183 million. It came down after representations, the pandemic’s financial impact on the airline, and BA’s remedial security work.
- Marriott International (2020): £18.4 million final, for a breach of millions of guest records from the Starwood reservation system. The original proposal was roughly £99 million.
- TikTok (2023): £12.7 million, for processing the personal data of children under 13 without appropriate parental consent, breaching Articles 5, 8, 12, and 13 of the UK GDPR.7Information Commissioner’s Office. ICO Welcomes Tribunal Ruling on Preliminary Issue Raised by TikTok in Its Appeal of 2023 Penalty
- Clearview AI (2022): £7.5 million, for scraping images of UK residents from the web and social media to build a facial recognition database, without a lawful basis and without informing the people involved.8Information Commissioner’s Office. UK Upper Tribunal Hands Down Judgment on Clearview AI Inc
The BA and Marriott gaps between proposed and final figures show that the representations stage is real, not procedural theater. Cooperation, remedial steps, and credible financial hardship arguments can move the number substantially.
The Enforcement Process
The ICO has to follow the statutory process in Section 155 of the Data Protection Act 2018 before it can require payment.5Legislation.gov.uk. Data Protection Act 2018 – Section 155 Penalty Notices
It starts with a notice of intent. This sets out the proposed fine and the reasoning. The organization then has a window to submit written representations challenging the findings, the amount, or both. This is the stage where the reductions in the BA and Marriott cases were secured.
If the ICO proceeds, it issues a penalty notice confirming the final amount. Payment is due within the period specified, which is at least 28 calendar days. The money goes to HM Treasury’s Consolidated Fund, not to the ICO.
Organizations that disagree can appeal to the First-tier Tribunal (General Regulatory Chamber). The tribunal reviews the decision on the merits, not just on procedure, and can cancel or reduce the fine.9GOV.UK. Information Rights and Data Protection – Appeal Against the Information Commissioner
Public Bodies Are Treated Differently
Public authorities and public bodies (as defined in Section 7 of the Data Protection Act 2018) sit under a separate ICO policy. The ICO prioritizes guidance, warnings, reprimands, and enforcement notices for public sector breaches, and reserves financial penalties for what it calls “the most egregious cases”: those involving real or potential harm, intentional or highly negligent conduct, or a pattern of repeat failures. Where a fine is imposed on a public body, the ICO may reduce the amount while keeping it meaningful enough to drive change.10Information Commissioner’s Office. Public Sector Approach
This softer approach does not extend to charities, social enterprises, or parish councils. They are treated like any other private organization.
Fines Against Organizations, Criminal Offenses Against People
UK GDPR fines are aimed at organizations. Individuals face a separate regime under Section 170 of the Data Protection Act 2018, which makes it a criminal offense for a person to knowingly or recklessly obtain, disclose, procure, or retain personal data without the controller’s consent, and a further offense to sell or offer to sell data obtained that way.11Legislation.gov.uk. Data Protection Act 2018 – Section 170 Unlawful Obtaining Etc of Personal Data
Only the ICO can bring these prosecutions. The penalty is a fine; there is no power of imprisonment for data protection offenses. A conviction is recordable and appears on police records. Defenses include acting to prevent or detect crime, acting under legal authority, reasonably believing the controller would have consented, and processing for journalism or literature where publication was reasonably believed to be in the public interest.
Changes Under the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and reforms parts of the UK GDPR and related regulations. The ICO has confirmed its fining guidance is under review in light of the new law.12Information Commissioner’s Office. Guide to Law Enforcement Processing – Penalties The core caps of £8.7 million and £17.5 million remain in place under current published guidance, and the two-tier structure, the ICO’s corrective powers, and the statutory enforcement process continue to operate as set out above. Organizations exposed to enforcement should watch the ICO’s website for updated guidance as more of the Act takes effect.