Information Commissioner's Office
UK data-protection regulator; Capita £14m fine; NCSC guidance as GDPR Article 32 standard.
On 12 May 2026 the Information Commissioner's Office imposed a £963,900 penalty on South Staffordshire Water over a 2022 ransomware intrusion, applying the Capita security standard while Parliament weighs a 24-hour breach-reporting duty.
Last refreshed: 12 October 2026 · Appears in 1 active topic
What exactly does the ICO expect companies to have in place to avoid a GDPR fine after a cyber attack?
Timeline for Information Commissioner's Office
Mentioned in: ASOS app pushes rogue alert to customers
Cybersecurity: Threats and DefencesReprimanded ACRO over patch management and alert investigation failures
Cybersecurity: Threats and Defences: ICO reprimands ACRO over patching failuresFined South Staffordshire Plc and South Staffordshire Water Plc £963,900 on 12 May 2026 under GDPR Article 32 and the Data Protection Act 2018
Cybersecurity: Threats and Defences: ICO fines South Staffs Water £963,900Mentioned in: Trellix discloses 21-day-old breach of source-code repository
Cybersecurity: Threats and DefencesMentioned in: FIRESTARTER implant survives every Cisco firewall patch
Cybersecurity: Threats and DefencesBackground
The ICO is Britain's Independent data-protection regulator, enforcing the UK GDPR and the Data Protection Act 2018. Its monetary penalty notices act as precedent for what UK organisations must do to secure personal data.
Two penalty notices from 2025 set the current standard. The ICO fined Capita £14m in October 2025 over its 2023 breach, and Advanced Computer Software £3.07m in March 2025 over a 2022 breach. Both cited missing Privileged Access Management controls and weak Active Directory tiering as Article 32 failures, so NCSC hygiene guidance now works as the enforceable technical baseline. Any British firm lacking those controls faces documented enforcement risk after a breach.
The ICO also uses reprimands. On 12 August 2026 it reprimanded ACRO Criminal Records Office after a website compromise exposed records on as many as 10,920 people, faulting unclear ownership of software updates and weak patching; network segmentation and remedial work kept ACRO below a fine. Disclosure speed is the next front: Trellix took 21 days to confirm a source-code breach in May 2026, 20 days outside the window the bill proposes.
Fines make security guidance enforceable
The ICO's penalty notice of 12 May 2026 found that the attacker phished into South Staffordshire's network, stayed hidden for 20 months, reached domain administrator and took 4.1 terabytes of data on 633,887 people. The water company was watching only 5 per cent of its IT estate. The regulator cut the fine by 40 per cent for early admission and issued it under GDPR Article 32 and the Data Protection Act 2018.
The ruling carried the Capita template into critical national infrastructure before MPs and peers finished the Cyber Security and Resilience Bill. That bill reached Report Stage on 2 March 2026 with a 24-hour initial incident report and a 72-hour full report, and gives the ICO a wider co-regulatory role beside Ofcom and DSIT.