Most UK GDPR Enforcement Actions Targeted Public Sector in 2024

The report analyzes the UK ICO’s 2024 enforcement actions, noting that most targeted public sector bodies and favored reprimands and enforcement notices over fines, in line with the regulator’s policy to limit financial penalties on public services. Only 18 fines were issued (mostly under PECR), with three GDPR-related fines tied to accidental data leaks (including PSNI and MOD) that were scaled back from initial amounts. The analysis highlights the stark contrast between the ICO’s restrained fining approach and significantly higher EU GDPR penalties, a trend expected to continue into 2025.