grc-scanSecurity & governance
← Back to home
ICO watch · UK28 October 2026 · next roundup Wednesday

ICO fines & breach roundup

Recent UK ICO enforcement in plain English — who was fined, why, and what a small business should learn from each. The mistakes repeat, and the fixes are cheap.

The takeaway

Neither story this week is about a clever attack: one is about organisations unable to see what their suppliers were doing, the other about data being treated as fair game because it was already public.

  • List every supplier that can reach your customer data, and ask each in writing how fast they would tell you about an incident.
  • Never scrape or buy a marketing list — "it was public" is not a lawful basis, and the PECR liability lands on you.
  • Get a named out-of-hours contact from your IT provider and keep it somewhere you could read it offline.

ICO fines & breach roundup — 28 October 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

The ICO's enforcement register added nothing this week — the last entries are the two Welsh reprimands of 14 October, covered here last Wednesday — and the media centre has published nothing since 20 October. So this is a short edition: a police inspectorate report on suppliers nobody was checking, and the ICO's power to fine an overseas company back in court. Two items, because that is what the week held.

1. Police suppliers were breached repeatedly since 2021 — and most contracts asked nothing about security

On 27 October His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published an inspection finding police forces and fire and rescue services in England not fully prepared for cyber attacks. The finding that travels outside policing is about suppliers. The Police Digital Service and the National Police Chiefs' Council gave inspectors information on multiple cyber attacks since 2021 on third-party ICT supply chains holding police information, and the inspectorate judged further attacks highly likely. The public report names no suppliers or forces and does not say whether data was taken. Inspectors found most supplier contracts contained no ongoing cyber-security assurance: some staff could not say whether suppliers had to report incidents promptly, and in several organisations suppliers' system logs were not routinely visible to in-house teams. The Police Digital Service warned that police data on suppliers' systems is among the sector's biggest risks because it sits outside its own monitoring. It recorded 252 cyber-security incidents affecting policing in the first three months of 2026, plus 796 near misses.

What your business should learn: If a police force cannot see what its suppliers are doing, you almost certainly cannot either — and most small businesses keep customer data in someone else's systems: the booking platform, the payroll bureau, the IT company with remote access. Two cheap jobs. Write down every supplier that holds or can reach your customer data, and beside each one note who you would actually phone at 7am on a Sunday. Then ask each supplier, in writing, to confirm that they will tell you about a security incident affecting your data, and how quickly. The email costs nothing and is itself evidence you asked. Remember the ICO treats a processor's failure as the controller's problem too — last week's Data Cymru reprimand turned on exactly that.

2. Clearview AI is back in court over whether the ICO could fine it at all — four years and counting

Clearview AI spent 19–21 October at the Court of Appeal (case CA-2026-000226) trying to overturn the ruling that the ICO can penalise it at all. The ICO fined the US facial-recognition company more than £7.5m in 2022 over a database built by scraping billions of images of faces from the web, including those of UK residents, and ordered it to delete UK data. In 2023 the First-tier Tribunal accepted that UK GDPR reached Clearview territorially but held the processing fell outside its material scope, because its customers were non-UK law-enforcement and national-security bodies — so the ICO had no jurisdiction. In October 2025 the Upper Tribunal reversed that, finding errors of law in the material-scope analysis and in a narrow reading of "behavioural monitoring", and sent the substantive appeal back to the First-tier Tribunal. No judgment has been given on the current appeal, and the ICO says it will not comment while the case is before the court.

What your business should learn: Ignore the facial recognition; the argument underneath is one small businesses make every week — "the data was already public, so we can use it." Every stage of this case has treated scraped photographs as personal data. What is disputed is only whether this particular foreign company is reachable. So: do not build a marketing list by scraping websites, LinkedIn or Companies House, and do not buy one unless the seller can show you the consent behind each name — "publicly available" is not a lawful basis, and under PECR the liability for the resulting calls and emails is yours, not the list seller's. The second lesson is about time: this penalty has been in dispute for four years. A quiet regulator is not a closed matter.

Sources

Would your business pass the same test?

Almost every fine above traces back to a handful of basics — MFA, patching, access control, lawful marketing. You can check where your business stands against the UK's baseline, free and in plain English, in a few minutes.

Check Cyber Essentials readiness →Check UK GDPR readiness

📣 Share this roundup

A short ready-made post built around this roundup's takeaway. Copy it, or open a platform and paste.

Share on X

Tip: X pre-fills the post. LinkedIn can't pre-fill text, so Copy + open LinkedIn copies the post for you — just paste (Ctrl/Cmd+V) into the box that opens (the link still shows the preview card). Pasting the link in the first comment instead of the body often gets more reach.

Past editions

Every Wednesday, compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.