Question

To ask the Secretary of State for Digital, Culture, Media and Sport, what enforcement action has been taken against organisations with inadequate data security since July 2024.

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the UK's data protection legislation independently of Government. The ICO has a range of powers to address organisations’ failures to comply with their data protection obligations, including where they have failed to implement appropriate security measures to protect personal data. These powers include enforcement notices, civil monetary penalties and, in certain circumstances, powers of prosecution. Information about enforcement action taken by the ICO since July 2024 is published on the ICO’s website (https://ico.org.uk/action-weve-taken/complaints-and-concerns-data-sets/) .