The Information Commissioner's Office (ICO), the UK data-protection regulator, fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 on Tuesday 12 May 2026 for a 2022 ransomware intrusion. The penalty notice, issued under GDPR Article 32 and the Data Protection Act 2018, includes a 40 percent reduction for early admission of the breach1. The attacker entered through a phishing email, dwelled inside the network for 20 months undetected, escalated to domain administrator, and exfiltrated 4.1 terabytes of data affecting 633,887 individuals.
South Staffs Water was actively monitoring only 5 percent of its information-technology estate during the dwell period, and the ICO found no Privileged Access Management controls in place. The same two findings, against the same National Cyber Security Centre control framework, drove the £14 million Capita fine in March 2026, where the ICO first established NCSC guidance as the enforceable GDPR technical baseline.
South Staffs Water is critical national infrastructure (CNI), and the Cyber Security and Resilience Bill currently before Parliament is the instrument that will eventually impose a statutory cyber framework on water utilities. The ICO has not waited. Under the existing Article 32 'appropriate technical and organisational measures' clause, the regulator has applied to a CNI water operator the same standard a fortnight before Parliament has finished writing the new rules. For water company boards, the change is immediate: the bar for 'appropriate' is now whatever NCSC guidance says, enforced through GDPR penalties calibrated against turnover. The 40 percent admission discount also signals an ICO preference for cooperation, but the underlying maths assumes the breach disclosure happens, which is the bill's own 24-hour reporting hinge.
