The Information Commissioner's Office took just 31 enforcement actions in 2025, down 50% from 62 in 2024, according to URM Consulting's analysis of the ICO's own Enforcement Register, published in 2026. Fewer actions did not mean less money changed hands: those 31 cases still produced 15 fines worth a combined GBP 21.7 million, alongside 9 enforcement notices and 7 reprimands.
How many enforcement actions did the ICO take in 2025?
31 is the total, drawn from URM Consulting's case-by-case review of the ICO's public Enforcement Register. That is roughly half of 2024's count of 62 actions, which itself was taken against 47 separate organizations. The drop was not spread evenly across the year; the ICO's own case log shows enforcement activity thinning out even as the fines it did issue grew larger.
Figure 1: The ICO's enforcement caseload roughly halved between 2024 and 2025. Source: URM Consulting, "Analysis of Enforcement Action by the ICO in 2025" (2026), citing the ICO Enforcement Register.
A regulator issuing half as many enforcement actions is not automatically a regulator going easy. What changed in 2025 was the mix and the size of individual cases, not just the count.
Sites collecting UK personal data are still squarely in scope of this enforcement activity; see our tracker of the average ICO fine and every confirmed UK GDPR penalty since 2023 for the case-by-case breakdown behind this trend.
How does the ICO split fines, reprimands and enforcement notices?
Fines were the largest single category in 2025: 15 monetary penalties totaling roughly GBP 21.7 million. Enforcement notices came next at 9, all issued to private companies over PECR marketing breaches such as unsolicited calls, texts, or emails. Reprimands, the ICO's lightest formal sanction, accounted for 7 cases, 6 of them against public sector bodies rather than private companies.
Figure 2: How the ICO's 31 enforcement actions split by type in 2025. Source: URM Consulting, "Analysis of Enforcement Action by the ICO in 2025" (2026).
That split shows a pattern that holds across recent ICO enforcement: the public sector tends to receive a reprimand for the same kind of failure that draws a fine in the private sector, a distinction URM Consulting and several UK law firms have flagged as a deliberate policy choice rather than an accident of casework.
How big is the average ICO fine now?
GBP 1.6 million is the average confirmed ICO fine across 2025's 15 cases, according to Bridewell's analysis of the ICO Enforcement Register, published June 2026 and extracted as of May 11 that year. That is more than ten times 2024's average of roughly GBP 147,000 and about 370% above 2023's average of GBP 675,000. The climb has continued into 2026: the first 5 fines confirmed that year already average close to GBP 3.2 million each, though the year is not yet complete.
Figure 3: Average ICO monetary penalty by year, 2023 through the first four and a half months of 2026. Source: Bridewell, "Average Value of ICO Monetary Penalties Up 370 Percent Since 2023" (June 2026).
| Year | Actions | Fines issued | Average fine |
|---|---|---|---|
| 2023 | Not disclosed in this breakdown | 22 | Roughly GBP 675K |
| 2024 | 62 | 17 | Roughly GBP 147K |
| 2025 | 31 | 15 | GBP 1.6M |
| 2026 (through May) | Not yet complete | 5 | Roughly GBP 3.2M |
Source: URM Consulting, "Analysis of Enforcement Action by the ICO in 2025" (2026); Bridewell, "Average Value of ICO Monetary Penalties Up 370 Percent Since 2023" (June 2026).
Fewer, bigger fines is now the pattern rather than the exception. A single large security-related fine can carry an entire year's average, the same distortion this table shows building since 2024.
This UK-only trend sits apart from the European Union's own GDPR enforcement, since UK GDPR has run as a separate post-Brexit regime with its own regulator since 2021; see our compilation of GDPR fines across the EU for the roughly EUR 7.1 billion in cumulative EU-wide penalties DLA Piper tracks over the same period, a figure the ICO's own totals are not counted inside.
Are most ICO actions about GDPR or marketing rules?
It is close to an even split. 17 of the 31 enforcement actions in 2025 were for UK GDPR or Data Protection Act 2018 breaches, the kind of case that follows a data breach or a security failure. The remaining 14 were PECR cases, the separate regime covering unsolicited marketing calls, texts, and emails, according to URM Consulting's category-by-category breakdown of the ICO's Enforcement Register.
Figure 4: ICO 2025 enforcement actions split by legal basis. Source: URM Consulting, "Analysis of Enforcement Action by the ICO in 2025" (2026).
Every one of the 9 enforcement notices issued in 2025 fell into the PECR category, while the fines and most reprimands sat on the UK GDPR side, which tracks with the pattern the ICO has followed since its biggest security-related fines started landing in 2023.
If a UK GDPR breach lands an organization on this list, the underlying gap is often a stale or missing privacy notice rather than the breach itself. A privacy policy generator built for UK GDPR keeps that disclosure current without waiting for a regulator to flag it.
Is the ICO's caseload rising even as enforcement actions fall?
Yes. Data protection complaints reaching the ICO jumped from 42,300 in 2024/25 to 76,700 in 2025/26, an 81% increase, according to the ICO's own Annual Report and Financial Statements for 2025/26, published July 24, 2026. Enforcement actions fell over roughly the same period, which points to a widening gap between how much oversight work is arriving and how much of it converts into a formal case.
Figure 5: ICO complaint handling performance against its own targets, 2025/26. Source: Information Commissioner's Office, Annual Report and Financial Statements 2025/26 (July 2026).
The ICO assessed and responded to just 27.4% of complaints within 90 days in 2025/26, against its own 80% target, and closed only 69% within 6 months, down sharply from 98% the year before. The regulator's own report attributes the surge in complaint volume to sustained demand for its services, arriving at the same time as resource constraints elsewhere in the system.
On audits specifically, neither URM Consulting's 2025 case review nor the ICO's own 2025/26 annual report publishes a single aggregate count of audits completed that year; BDO's periodic tracker of ICO enforcement reported 14 to 20 audits per roughly six-month reporting window through early 2024 but has not broken out an audit count in its more recent updates covering March 2025 through May 2026. Treat any specific 2025 or 2026 audit total as unconfirmed until the ICO publishes one directly.
The Bottom Line
31 enforcement actions in 2025 is the right headline number for anyone measuring ICO activity by case count, and it is genuinely half of 2024's total. But the money moved in the other direction: 15 fines worth GBP 21.7 million, plus a growing backlog of complaints the ICO itself admits it is not clearing on target, tell a story of a regulator doing less overall casework while making the cases it does bring count for more. For any organization handling UK personal data, the practical read is the same either way: the ICO is not chasing volume, and a current, accurate privacy notice remains the cheapest way to stay off this list.
Frequently Asked Questions
How many enforcement actions did the ICO take in 2025? 31 enforcement actions, down 50% from 62 in 2024, according to URM Consulting's analysis of the ICO's own Enforcement Register, published in 2026.
How does the ICO split fines, reprimands and enforcement notices? Of the 31 actions in 2025, 15 were fines totaling roughly GBP 21.7 million, 9 were enforcement notices (all PECR marketing cases against private companies), and 7 were reprimands (6 to public sector bodies).
Are most ICO enforcement actions about GDPR or marketing rules? It is close to even. 17 of the 31 actions in 2025 were for UK GDPR or Data Protection Act breaches, while the remaining 14 were PECR marketing violations such as unlawful calls, texts or emails.
Is the ICO getting slower at handling complaints? Yes, by its own numbers. The ICO assessed only 27.4% of complaints within 90 days in 2025/26, against an 80% target, and closed just 69% within 6 months, down from 98% the year before, according to its Annual Report and Financial Statements for 2025/26.
Where the Numbers Come From
- URM Consulting. (2026). "Analysis of Enforcement Action by the ICO in 2025: Actions Way Down, Security Data Breach Fines Way Up." Source of the 31-action total, the 15/9/7 fine, notice and reprimand breakdown, the 62-action 2024 comparison, and the 17/14 UK GDPR versus PECR split.
- Bridewell. (2026). "Average Value of ICO Monetary Penalties Up 370 Percent Since 2023." Published June 8, 2026, citing the ICO Enforcement Register extracted May 11, 2026. Source of the GBP 1.6 million 2025 average fine and the year-by-year average trend.
- BDO. "Information Commissioner's Office (ICO) Enforcement Trends." Periodic tracker of ICO enforcement action by reporting window, including historical audit counts through early 2024.
- Information Commissioner's Office. "Enforcement action we've taken." The primary public Enforcement Register both URM Consulting and Bridewell draw their case-level data from.
Note: All figures verified as of October 2026. The exact count of 2025 enforcement notices is reported as 9 by URM Consulting's category breakdown, which together with 15 fines and 7 reprimands sums to the reported 31-action total; some secondary coverage of the same dataset rounds fine counts to "14 to 15," a discrepancy this post follows URM Consulting's own itemized breakdown to resolve. ICO enforcement data is refreshed at least twice a year as new case decisions are published.
