The average ICO fine reached £1.6 million in 2025, up roughly 370% from about £675,000 in 2023, according to Bridewell's analysis of the Information Commissioner's Office's own Enforcement Register, published June 2026. The regulator issued fewer penalties that year, just 14 to 15 depending on the tracker, but the total, £21.7 million, was the highest on record. One case, Capita's £14 million fine, accounted for close to two-thirds of it.
What is the biggest ICO fine of 2025?
Capita plc and Capita Pension Solutions Limited received a combined £14 million fine on October 15, 2025, the largest single UK GDPR penalty the ICO issued that year and the third-largest in ICO history. The penalty split £8 million to Capita plc and £6 million to CPSL, over a March 2023 cyberattack that compromised the data of 6,656,037 people. A malicious file was downloaded onto an employee device, a high-priority security alert fired within 10 minutes, and Capita still took 58 hours to quarantine the device while the attacker moved through its systems.
Figure 1: Capita's £14 million penalty was the ICO's largest confirmed fine of 2025. Source: Information Commissioner's Office, press release, October 15, 2025.
The ICO had originally intended to fine Capita £45 million but accepted a reduced, voluntary settlement of £14 million after considering mitigating factors, the same pattern of steep reductions seen in the ICO's biggest fines against British Airways and Marriott before it.
How much has the average ICO fine grown since 2023?
£1.6 million is the average confirmed ICO fine across 2025, more than 10 times 2024's average of roughly £147,000 and about 370% above 2023's average of £675,000, based on Bridewell's analysis of the ICO's own Enforcement Register, extracted May 11, 2026. That climb has continued into 2026: the 5 fines confirmed by the extraction date already average close to £3.2 million each, though the year is not yet complete and more penalties are likely to land before December.
Figure 2: Average ICO monetary penalty by year, 2023 through the first four and a half months of 2026. Source: Bridewell, "Average Value of ICO Monetary Penalties Up 370 Percent Since 2023" (June 2026), citing the ICO Enforcement Register.
| Year | Penalties issued | Total value | Average fine |
|---|---|---|---|
| 2023 | 22 | Roughly £15.0M | Roughly £675K |
| 2024 | 17 | £2.5M to £2.7M | Roughly £147K |
| 2025 | 14 to 15 | £21.7M | £1.6M |
| 2026 (through May 11) | 5 | £15M+ | Roughly £3.2M |
Source: Bridewell's analysis of the ICO Enforcement Register (June 2026); 2024 and 2025 totals cross-checked against URM Consulting's case-by-case 2025 enforcement review.
This UK-only trend sits apart from the European Union's own GDPR fine totals, since UK GDPR has run as a separate post-Brexit regime with its own regulator since 2021; see our compilation of GDPR fines across the EU for the roughly EUR 7.1 billion in cumulative EU-wide penalties DLA Piper tracks over the same period, a figure the ICO's own totals are not counted inside.
Fewer, bigger cases is now the pattern rather than the exception, and it shows no sign of reversing in 2026.
How many ICO fines are issued each year?
The ICO issued 22 monetary penalties in 2023, 17 in 2024, and only 14 to 15 in 2025, even as the pound value of those penalties climbed sharply. Total enforcement activity, including reprimands and enforcement notices alongside fines, also fell from 62 actions in 2024 to 31 in 2025, roughly a 50% drop, according to URM Consulting's review of the same Enforcement Register data.
Figure 3: Number of ICO monetary penalties issued per year, 2023 through the first four and a half months of 2026. Source: URM Consulting, "Analysis of Enforcement Action by the ICO in 2025" (2026), and Bridewell's Enforcement Register analysis.
Fewer cases with much larger fines each suggests the ICO is concentrating its 2025 and 2026 enforcement resources on the security failures it considers most serious, rather than spreading penalties across a wider range of smaller infringements.
How much of the 2025 total comes from one company?
Capita's £14 million fine alone equals roughly 64.5% of the £21.7 million the ICO collected in penalties across all of 2025. No other single case comes close: the next largest, Advanced Computer Software Group's £3.07 million fine from March 2025 over a ransomware attack that disrupted 82 NHS organizations, is only about 14% of the yearly total.
Figure 4: Capita's single fine accounts for close to two-thirds of every pound the ICO collected in monetary penalties in 2025. Source: ICO press release (October 2025) and Bridewell's Enforcement Register analysis (June 2026).
A single case reshaping the entire yearly total is exactly why citing the raw £21.7 million figure without naming Capita understates how concentrated 2025's enforcement really was.
What were the biggest ICO fines of 2025, ranked?
Six named cases account for most of 2025's confirmed penalty value: Capita and CPSL at £14 million, Advanced Computer Software Group at £3.07 million, 23andMe's UK entity at £2.31 million for a 2023 breach affecting 155,592 UK users, LastPass UK at roughly £1.23 million for a 2022 breach affecting up to 1.6 million UK users, DPP Law at £60,000, and the adoption charity Birthlink at £18,000 for the unnecessary destruction of adoption records that caused serious, permanent harm.
Figure 5: The six largest confirmed ICO fines of 2025, ranked. Source: URM Consulting, "Analysis of Enforcement Action by the ICO in 2025" (2026), and individual ICO enforcement notices.
Every one of the six named 2025 fines traces back to a cyberattack or a security failure, not a marketing or cookie-consent violation, a real shift from the PECR telemarketing fines that dominated the ICO's docket in earlier years. If a UK GDPR breach lands your organization in this tracker, the underlying paperwork gap is often a stale or missing privacy notice rather than the breach itself; a privacy policy generator built for UK GDPR keeps that disclosure current without waiting for a regulator to flag it.
How does Capita's fine compare to the ICO's all-time record?
Capita's £14 million penalty is the third-largest fine in ICO history, behind only British Airways' £20 million fine and Marriott International's £18.4 million fine, both issued in October 2020 over 2018-era data breaches. A fourth major case, Clearview AI's £7.5 million fine, remains disputed rather than settled.
| Organization | Fine | Date | Status |
|---|---|---|---|
| British Airways | £20,000,000 | Oct 2020 | Final; 2018 breach, ~400,000 customers |
| Marriott International | £18,400,000 | Oct 2020 | Final; Starwood database breach |
| Capita plc / CPSL | £14,000,000 | Oct 2025 | Final; 2023 cyberattack, 6.66M people |
| Clearview AI | £7,500,000 | Issued 2022 | Disputed; overturned 2023, ICO appeal upheld Oct 2025 |
| Advanced Computer Software | £3,070,000 | Mar 2025 | Final; ransomware hit 82 NHS bodies |
| 23andMe (UK entity) | £2,310,000 | Jun 2025 | Final; 2023 breach, 155,592 UK users |
Source: Information Commissioner's Office enforcement notices; National Law Review case summaries for British Airways and Marriott.
Clearview AI's £7.5 million fine, issued in May 2022, was overturned by the First-tier Tribunal in October 2023 on jurisdictional grounds. The ICO appealed, and the Upper Tribunal ruled largely in the regulator's favor on October 7, 2025, remitting the case back to the First-tier Tribunal for substantive reconsideration. As of this post's publication, the fine has not been finally reinstated, so it is not counted in this tracker's 2025 totals above.
The Bottom Line
£1.6 million is the fair headline number for the average confirmed ICO fine in 2025, and it is nearly five times higher than 2024's average of roughly £147,000. But that average is carried by a single case: Capita's £14 million penalty alone makes up close to two-thirds of the year's £21.7 million total, and outside of the six named security-related fines, 2025's enforcement activity was actually thinner than 2024's by count. The practical read for any organization handling UK personal data is that the ICO is not issuing more fines, it is issuing far bigger ones when a security failure is involved, and a current, accurate privacy notice remains the cheapest insurance against becoming the next line in this tracker.
Frequently Asked Questions
What is the average ICO fine in 2025? £1.6 million across the 14 to 15 monetary penalties the ICO issued in 2025, according to Bridewell's analysis of the ICO's own Enforcement Register (June 2026), up from about £675,000 in 2023.
What is the biggest ICO fine ever issued? British Airways' £20 million fine from October 2020 remains the largest ICO penalty on record, followed by Marriott International's £18.4 million fine the same month and Capita's £14 million fine in October 2025.
How much did the ICO fine Capita? £14 million, announced October 15, 2025, split between an £8 million penalty on Capita plc and a £6 million penalty on Capita Pension Solutions Limited, over a 2023 cyberattack that exposed the data of 6,656,037 people.
Is the Clearview AI £7.5 million ICO fine still valid? It remains unresolved. The ICO's original £7.5 million fine was overturned by a tribunal in October 2023, the ICO's appeal was largely upheld by the Upper Tribunal in October 2025, and the case has been sent back to the First-tier Tribunal for reconsideration.
Where the Numbers Come From
- Bridewell. (2026). "Average Value of ICO Monetary Penalties Up 370 Percent Since 2023." Published June 8, 2026, citing the ICO Enforcement Register extracted May 11, 2026. Source of the 2023-2026 average-fine trend used throughout this post.
- Information Commissioner's Office. (2025). "Capita Fined £14m for Data Breach Affecting Over 6m People." Press release, October 15, 2025.
- Information Commissioner's Office. (2025). "LastPass UK Ltd." Enforcement action page, November 2025.
- Information Commissioner's Office. (2025). "UK Upper Tribunal Hands Down Judgment on Clearview AI Inc." October 7, 2025.
- URM Consulting. (2026). "Analysis of Enforcement Action by the ICO in 2025: Actions Way Down, Security Data Breach Fines Way Up." Case-by-case 2025 breakdown, including Advanced Computer Software, 23andMe, LastPass, DPP Law, and Birthlink.
- National Law Review. (2020). "ICO Issues Record £20 Million Fine to British Airways." October 2020 case summary, the largest confirmed ICO fine on record.
Note: All figures verified as of October 2026. The exact count of 2025 monetary penalties varies by tracker (14 in Bridewell's Enforcement Register analysis, 15 in URM Consulting's case-by-case review), though both land on the same £21.7 million total. ICO enforcement data is refreshed at least twice a year as new penalty notices are published.
