Search

How can we help?

Icon

ICO Fines – Don’t fall foul of the rules

Back in March, Cathay Pacific were fined £500,000 for failing to protect the security of its customers’ personal data.  This used to be the largest fine that the ICO could impose under the Data Protection Act 1998 but the Data Protection Act 2018 now allows for a fine of anywhere up to 20 million euros or 4% of annual worldwide turnover, whichever is greater.

There have also been a number of fines imposed over recent months for unsolicited marketing emails and calls including two this month, namely:

  • £100,000 fine for Koypo Laboratories Limited for instigating 21,166,574 unsolicited marketing emails without consent
  • £80,000 fine for Rain Trading Limited for making 270,774 unsolicited marketing  calls to individuals without consent

Cathay Pacific were fined £500,000 for failing to protect the security of its customers’ personal data.

In the current economic crisis it would not be surprising if more businesses turned their attention to marketing but these fines are a stark warning to organisations to ensure they comply with data protection obligations in doing so.

Please do not hesitate to get in contact with our data protection team if you have any questions.

Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

Author profile

About this article

Read, listen and watch our latest insights

art
  • 29 October 2026
  • Immigration

UK Immigration shake-up: More flexibility for skilled workers, but at what cost?

The UK Government has outlined further changes to its immigration system, with new measures affecting international graduates, sponsored workers, and businesses employing overseas talent.

art
  • 28 October 2026
  • Privacy and Data Protection

Remote working: 5 key data protection risks for employers

Remote working has become more prominent in modern business. While flexible working arrangements can improve productivity and employee wellbeing, they also create new data protection risks. Regardless of the physical location in which work is done, compliance with UK GDPR does not change.

art
  • 27 October 2026
  • Employment

Fire and Rehire update: Key changes delayed

The Government has published two documents giving key updates to the anticipated changes around ‘fire and rehire’ and restricted contractual variations, coming about as a result of the Employment Rights Act 2025 (“ERA 2025”). We now understand that these changes will now be delayed to March, rather than January 2027.

art
  • 26 October 2026
  • Corporate and M&A

Shareholders’ Agreements for Founders and Investors – SHA Series Part 3 of 5

A shareholders’ agreement is arguably one of the most valuable corporate governance agreements (along with articles of association) in any private UK company with more than one shareholder.

art
  • 23 October 2026
  • Litigation and dispute resolution

Section 172 Companies Act 2006: Key lessons from Saxon Woods v Costa

The Supreme Court’s decision in Saxon Woods v Costa UKSC 21 clarifies directors’ duties under Section 172 Companies Act 2006, confirming that good faith requires both honest belief and appropriate conduct.

art
  • 19 October 2026
  • Immigration

Right to Work Checks: Are UK businesses becoming immigration enforcement officers?

The UK’s Right to Work regime has undergone a significant expansion, with changes taking effect from 1 October 2026.