How much can the ICO fine you under UK GDPR?

What are the maximum UK GDPR fines?

The level depends on which rule has been broken. Within each level, the turnover calculation can produce a larger maximum than the fixed amount. These are UK limits in pounds.

Does every breach lead to the maximum fine?

No. The ICO must decide what is effective, proportionate and enough to discourage further breaches in the case before it. The legal ceiling and the actual fine are different questions.

It considers how serious the breach was, how long it lasted, how many people it affected and the harm caused. It also looks at whether the conduct was deliberate or careless, and the steps taken to reduce the harm.

Whose turnover counts in a group of companies?

The law uses the word “undertaking”. This means an entity involved in economic activity, whatever its legal form or funding. Where companies form one undertaking, the turnover can be that of the whole group, rather than just one company in it.

That is why a turnover figure from a single company’s accounts may not settle the maximum. If the group structure matters to your case, it is a point to raise with your legal adviser.

What does the ICO say about smaller organisations?

In its guidance for small organisations, the ICO says its focus is on helping them comply. It also says it takes sensible steps to reduce risk into account. That does not remove the power to fine.

The useful task is to keep improving how you handle data. The ICO describes data protection as ongoing risk management because people and systems change. Treat the maximum fine as a legal limit, not a reason to buy a service in a panic.

What to do

1. Check which rule and fine level are relevant to the issue.
2. If turnover affects the limit, check which companies form the undertaking.
3. Record the steps taken to reduce harm and improve controls.
4. Keep reviewing risks as people and systems change.

Common questions

Is the higher limit always £17.5 million?

No. For an undertaking, 4% of worldwide annual turnover in the preceding financial year applies if it is higher.

Is every data breach fined?

The ICO considers the case and its response. Its small organisation guidance says the focus is on helping organisations comply, rather than fines.

Does only the subsidiary’s turnover count?

Not necessarily. Where companies form one undertaking, the relevant turnover can be the whole group’s.

Where next

• After a breach or ICO contact
• ICO has written to you: what to do in the first week
• How do I choose a data protection or AI governance adviser?
• A data breach has happened: who do you call?

This is an independent editorial guide, not legal advice.