How many enforcement actions has the UK ICO published?

222 actions appear in the ICO's published enforcement register as of 2026-09-02, carrying 223 action-type labels between them: 98 reprimands, 64 monetary penalties, 55 enforcement notices, 6 prosecutions. That is a count of what the register publishes, not of every action the ICO has ever taken.

What kinds of action does the ICO take most often?

In the register as published on 2026-09-02, the most common action-type label is reprimands (98 of 222 actions), ahead of monetary penalties (64) and enforcement notices (55). These are counts of one register at one moment; they are not a prediction of what any particular investigation leads to.

Which sectors appear most often in ICO enforcement?

Across 19 sector labels: Marketing (28), Criminal justice (26), General business (20), Local government (20), Finance insurance and credit (19), Health (16), Central government (14), Utilities (11). A further 40 actions carry no sector label. Sector names are the register's own.

Can I reuse these counts?

Yes. The tabulation, the CSV and the charts are published under CC BY 4.0 with attribution to ComplianceDocs, and a link to this page is the attribution we ask for. The underlying register is ICO content under the Open Government Licence v3.0; if you reuse the register's own text rather than this tabulation, the ICO asks for: "Information Commissioner’s Office, enforcement action register, licensed under the Open Government Licence v3.0."

What the UK ICO Actually Does: Enforcement Actions in Numbers

The UK Information Commissioner’s Office publishes every enforcement action it takes, one page per action, with no aggregate view of any kind. Counted across all 222 actions in that register as it stands on 2026-09-02: 98 are reprimands, 64 are monetary penalties, 55 are enforcement notices and 6 are prosecutions. This is a composition of the register, not a history of everything the ICO has ever done, and deliberately not a series over time — the reason is in the method note.

Reviewed by Dor Israel, Founder · Updated September 2, 2026

What the register contains, by action type

The ICO's enforcement register lists each action on its own page and can be filtered, but it publishes no counts. Reading every entry and counting the register's own action-type labels gives the composition below.

The most common label in the register is reprimands: 98 of 222 actions carry it. One action carries more than one type label, which is why the counts below sum to 223 rather than 222.

These are the register's labels, used as the register uses them. What each type means in law, and what the ICO can do under each, is set out by the ICO itself at the source link in the method note — this page counts, it does not interpret.

UK ICO enforcement actions by action type (all 222 actions in the published register, 2026-09-02)

Action type	Actions
Reprimands	98
Monetary penalties	64
Enforcement notices	55
Prosecutions	6

Counts of the register's own action-type labels. One action carries two labels, so the column sums to 223 across 222 actions. Source: Information Commissioner's Office enforcement register, snapshot 2026-09-02.

By sector

The register also labels most actions with a sector. 19 distinct sector labels appear across the 222 actions, and 40 actions carry no sector label at all — those 40 are counted in every total on this page but appear in no sector row below.

The table shows every sector the register uses, largest first. The chart below it shows the 8 most frequent, and says so in its own subtitle so a chart reused on its own cannot read as a complete list.

UK ICO enforcement actions by sector (19 sectors across 222 actions, 2026-09-02)

Sector	Actions
Marketing	28
Criminal justice	26
General business	20
Local government	20
Finance insurance and credit	19
Health	16
Central government	14
Utilities	11
Online technology and telecoms	7
Retail and manufacture	5
Charitable and voluntary	4
Education and childcare	3
Legal	2
Transport and leisure	2
Land or property services	1
Media	1
Political	1
Regulators	1
Social care	1
No sector label	40

Sector names are the register's own, taken from its filter controls. An action carries at most one sector label. Source: Information Commissioner's Office enforcement register, snapshot 2026-09-02.

How this was computed, and the two things it deliberately does not say

Computed from every entry in the ICO’s published enforcement register, read through the search endpoint its own filter UI uses. Action types and sectors are the register’s own labels, parsed against the vocabularies published in its filter controls. Counts describe the register as published at the snapshot date; they are not a history of all action the ICO has ever taken.

No series over time. The ICO’s enforcement filter page states: "When searching by date, incorrect results may be produced due to errors with the dates of some documents added before 31 December 2024." Most of the register predates that, so no per-year series is computed or published. The register's oldest entry carries the date label 22 January 2022 and its newest 7 August 2026, and those two labels are the only dates quoted anywhere on this page.

No total of fines. A pound figure appears in only some entry descriptions, and those that carry one mix monetary penalties with Proceeds of Crime Act confiscation amounts, so no total of fines is computed.

Source and license. Information Commissioner’s Office enforcement register, https://ico.org.uk/action-weve-taken/enforcement/, read on 2026-09-02. ICO content is published under the Open Government Licence v3.0, which is why this tabulation can exist; the attribution the ICO asks for is: "Information Commissioner’s Office, enforcement action register, licensed under the Open Government Licence v3.0."

What these numbers are not. They are not a count of every action the ICO has ever taken — only of what its enforcement register publishes at the snapshot date. They are not a measure of how likely any organization is to be investigated or fined, and nothing here is legal advice. No template makes an organization compliant on its own.

Charts, dataset and reuse

The charts and the underlying tabulated dataset on this page are published under CC BY 4.0: reuse them in your own article, report or deck, with attribution to ComplianceDocs — a link back to this page is the attribution form we ask for. The underlying government register is public information; the license covers this tabulation and these charts.

Bar chart of UK ICO enforcement actions by action type in the published register: Reprimands 98, Monetary penalties 64, Enforcement notices 55, Prosecutions 6 — Action-type labels across all 222 actions in the register. One action carries two labels, so the bars sum to 223. · Download SVG

Bar chart of the eight most frequent sectors in the UK ICO enforcement register: Marketing 28, Criminal justice 26, General business 20, Local government 20, Finance insurance and credit 19, Health 16, Central government 14, Utilities 11 — The 8 most frequent of 19 sector labels. A further 40 actions carry no sector label; the full list is in the table above. · Download SVG

Dataset: UK ICO enforcement actions by sector and action type (CSV; snapshot-dated, methodology above).

Cite this data

ComplianceDocs, “UK ICO enforcement actions by sector and action type,” https://compliancedocshq.com/learn/uk-ico-enforcement-statistics. Underlying register as named in the method note.

Embed a chart

Copy and paste — the snippet credits the source for you:

<a href="https://compliancedocshq.com/learn/uk-ico-enforcement-statistics"><img src="https://compliancedocshq.com/charts/ico-enforcement-by-type.svg" alt="Bar chart of UK ICO enforcement actions by action type in the published register: Reprimands 98, Monetary penalties 64, Enforcement notices 55, Prosecutions 6" width="720" style="max-width:100%;height:auto"></a>
<p>Source: <a href="https://compliancedocshq.com/learn/uk-ico-enforcement-statistics">ComplianceDocs — What the UK ICO Actually Does: Enforcement Actions in Numbers</a></p>

Frequently asked questions

How many enforcement actions has the UK ICO published?: 222 actions appear in the ICO's published enforcement register as of 2026-09-02, carrying 223 action-type labels between them: 98 reprimands, 64 monetary penalties, 55 enforcement notices, 6 prosecutions. That is a count of what the register publishes, not of every action the ICO has ever taken.
What kinds of action does the ICO take most often?: In the register as published on 2026-09-02, the most common action-type label is reprimands (98 of 222 actions), ahead of monetary penalties (64) and enforcement notices (55). These are counts of one register at one moment; they are not a prediction of what any particular investigation leads to.Related: GDPR enforcement and fines across Europe
Which sectors appear most often in ICO enforcement?: Across 19 sector labels: Marketing (28), Criminal justice (26), General business (20), Local government (20), Finance insurance and credit (19), Health (16), Central government (14), Utilities (11). A further 40 actions carry no sector label. Sector names are the register's own.
Why is there no chart of ICO actions per year here?: Because the publisher warns the dates are not reliable for most of the period. The ICO's own enforcement filter page states: "When searching by date, incorrect results may be produced due to errors with the dates of some documents added before 31 December 2024." Most of this register predates that, so no per-year series is computed or published — every figure on this page is dateless composition.
Can I reuse these counts?: Yes. The tabulation, the CSV and the charts are published under CC BY 4.0 with attribution to ComplianceDocs, and a link to this page is the attribution we ask for. The underlying register is ICO content under the Open Government Licence v3.0; if you reuse the register's own text rather than this tabulation, the ICO asks for: "Information Commissioner’s Office, enforcement action register, licensed under the Open Government Licence v3.0."

Related guides: GDPR

Toolkits that help

EU GDPR

GDPR Compliance Pack for Small Business

14 editable GDPR documents — privacy notices, DSAR procedure, DPIA, breach response, processor DPA checklist — plus a pre-filled Records of Processing Activities (Art. 30) workbook and evidence checklist.

$79View toolkit

ISO/IEC 27001:2022

ISO 27001 Policy Pack — Core

16 editable ISO/IEC 27001:2022 policies plus the full 93-control Statement of Applicability — everything a small business needs to start its ISMS.

$59View toolkit

Get new templates and guides by email

An occasional email when we publish a new free template, guide, or dataset. Unsubscribe any time.

← All articles