How the ICO Calculates a UK GDPR Fine: The Five Steps in Its Data Protection Fining Guidance

Where the Fining Power Comes From

The power to fine is statutory, and the guidance is the regulator's account of how it will use it. Section 155 of the Data Protection Act 2018 provides for penalty notices, and for a notice concerning a matter to which the UK GDPR applies it points to "the matters listed in Article 83(1) and (2)" of the UK GDPR. Article 83 sets out those matters and the two fine ceilings. Section 156 then restricts penalty notices in four situations the guidance lists: processing for the special purposes of journalism, academic, artistic or literary expression without a court's leave, processing determined by either House of Parliament, the Crown Estate Commissioners and controllers acting for the Royal Household and the Duchies of Lancaster and Cornwall, and certain joint controller arrangements in law enforcement and intelligence processing.

The Data Protection Fining Guidance states that it is published under the section 160 duty to issue guidance about penalty notices, that it has been presented to Parliament under section 160(11), and that it replaces the penalty sections of the Regulatory Action Policy published in November 2018. By its own description it covers penalty notices for infringements of the UK GDPR, Part 3 of the 2018 Act (law enforcement processing) and Part 4 (intelligence services processing), and for failures to comply with information, assessment and enforcement notices. The ICO announced it on 18 March 2024, after consulting on a draft the previous year.

Two Ceilings, and the Turnover at Which Each Switches

Section 157 and Article 83(4) and (5) set a standard maximum and a higher maximum. The standard maximum is £8,700,000 or, for an undertaking, 2% of total annual worldwide turnover in the preceding financial year if that is higher. The higher maximum is £17,500,000 or 4% on the same basis. Article 83(6) applies the higher figure to non-compliance with an order under Article 58(2), and section 157(4) applies it to failures to comply with an information notice, an assessment notice, an enforcement notice and, since 5 February 2026, an interview notice added by the Data (Use and Access) Act 2025. A new subsection (4A), in force from 19 June 2026, applies the standard maximum to infringements of section 164A or regulations under section 164B.

The guidance converts those formulas into break-points. The percentage governs only where turnover exceeds £435 million for the standard maximum or £437.5 million for the higher maximum, because 2% of £435 million is £8.7 million and 4% of £437.5 million is £17.5 million. Below those figures the fixed sums are the ceiling.

Turnover Belongs to the Undertaking, Not the Company Fined

Neither the UK GDPR nor the 2018 Act defines "undertaking" for fining purposes. The guidance relies on Recital 150, which ties the term to Articles 101 and 102 of the Treaty on the Functioning of the European Union, and on UK competition case law. An undertaking is "any entity that is engaged in economic activity, regardless of its legal status or the way in which it is financed," which the ICO says can include public authorities, state-controlled enterprises and charities carrying on economic activity, and it may comprise several legal or natural persons forming a "single economic unit."

Where a controller is a subsidiary, the maximum is calculated on the turnover of the undertaking as a whole. Whether a parent belongs to that unit depends on decisive influence, judged by economic, organisational and legal links such as shareholding and board representation. Where a parent owns "all, or nearly all, the voting shares" in a subsidiary there is a rebuttable presumption of decisive influence, and the burden falls on the parent to show the subsidiary acts independently. The guidance adds that the Commissioner may hold a parent jointly and severally liable for payment, citing its 4 April 2023 TikTok decision.

One Cap for Linked Processing

Article 83(3) provides that where a controller or processor infringes several provisions "for the same or linked processing operations," the total fine may not exceed the amount specified for the gravest infringement. The guidance treats operations as linked where they serve a particular purpose or the same means of processing, relate to the same or a similar group of data subjects, and take place concurrently, sequentially or close in time. Its example is an information society service fined for infringing both Article 8 and Article 13, where the combined fines cannot exceed the higher maximum that attaches to Article 13. Infringements arising from separate conduct, such as a security breach and unrelated marketing transparency failures, are each capped separately even if they appear in one penalty notice. The 2018 Act has no equivalent of Article 83(3), and the ICO says it applies the same approach to Parts 3 and 4 for consistency.

The Five Steps

Step 1: seriousness

Step 1 assigns a starting point as a percentage of the relevant statutory maximum, reflecting the nature, gravity and duration of the infringement, whether it was intentional or negligent, and the categories of personal data affected. The guidance says there is "no pre-set 'tariff'" and uses three bands:

• lower degree of seriousness: between 0% and 10% of the relevant legal maximum
• medium degree of seriousness: between 10% and 20%
• high degree of seriousness: between 20% and 100%

For an undertaking above the £435 million or £437.5 million line, the percentage applies to the turnover-based maximum; otherwise it applies to the fixed sum. The guidance's illustration is a high-seriousness starting point of 40% of the higher maximum, which for a controller subject to the fixed amount equals £7 million.

Step 2: turnover

Step 2 lets the Commissioner reduce the starting point to reflect the size of the undertaking, using turnover for the financial year before the penalty notice, generally from consolidated audited accounts. The indicative ranges, expressed as a percentage of the Step 1 figure, are:

The ranges are "only indicative," and the Commissioner "retains the discretion to impose a fine up to the applicable statutory maximum." Where a controller or processor is not an undertaking and has no turnover, the ICO may look instead at indicators such as assets, funding or administrative budget.

Step 3: the starting point in pounds

Step 3 combines the first two. Where the maximum is a fixed sum, the fixed maximum is multiplied by the seriousness percentage and then by the turnover adjustment; where it is turnover-based, turnover is multiplied by the statutory percentage and then by the seriousness percentage. In the guidance's Example A, a medium-seriousness infringement set at 16% of the higher maximum by a business with £30 million turnover, adjusted at 5%, gives £17.5 million multiplied by 16% and by 5%, a starting point of £140,000. In Example B, a high-seriousness infringement set at 40% by an undertaking with £800 million turnover, with no Step 2 adjustment, gives £800 million multiplied by 4% and by 40%, or £12.8 million.

Steps 4 and 5: factors and a final check

Step 4 applies aggravating or mitigating factors, which may take the figure above or below the indicative range. Step 5 tests whether the result is effective, proportionate and dissuasive, considering specific and general deterrence, and may raise or lower it. For several infringements from linked processing, the ICO assesses both each fine and the combined total. The guidance states that a controller or processor responsible for a serious infringement "should not avoid a fine solely on the basis of its financial position," and a final check keeps the amount within the statutory maximum.

A financial hardship reduction is available only in exceptional circumstances, on a claim the organisation or individual must prove, and only on objective evidence that the fine "would irretrievably jeopardise an organisation's economic viability or bankrupt an individual." A loss-making position alone is not enough, and the ICO may instead agree extra time to pay or payment by instalments.

How the ICO Reads the Article 83(2) Factors

The guidance's treatment of aggravating and mitigating factors follows Article 83(2) and section 155(3), but narrows several of them:

• the ordinary duty of cooperation with the Commissioner "is required by law" and is not mitigation; cooperation counts where it concludes enforcement significantly more quickly or effectively or significantly limits harm, and persistent delay can aggravate
• a breach notification the law requires is not mitigation "even if made promptly"; bringing an infringement the ICO did not already know about to its attention can be
• the absence of previous infringements is not a mitigating factor "because compliance with the UK GDPR and DPA 2018 is expected"
• the degree of responsibility for technical and organisational measures is more likely to be aggravating or neutral, and mitigation requires showing the controller or processor "has gone over and above its obligations"
• failing to comply with an approved code of conduct or certification mechanism relevant to the infringement may aggravate and may be evidence of intent or negligence

On seriousness, the guidance describes an infringement as intentional where the controller or processor "wilfully ignored the known risk of its conduct infringing the law," and as negligent where it breached the duty of care the legislation requires, with examples including a failure to adopt data protection policies and human error by staff without adequate training. It may give more weight to processing involving children or other vulnerable people, a clear imbalance of power, or large-scale and systematic profiling.

Notice of Intent, Representations and Appeal

The procedure sits in Schedule 16 to the 2018 Act. Before a penalty notice, the Commissioner must give a notice of intent that sets out the reasons and "an indication of the amount of the penalty the Commissioner proposes to impose, including any aggravating or mitigating factors," allows at least 21 days for written representations, and offers oral representations where the Commissioner considers that appropriate. A penalty notice cannot be given before the representation period ends, and any representations must be considered.

The time limit changed on 5 February 2026. As originally enacted, paragraph 2(2) barred giving a penalty notice in reliance on a notice of intent after six months, and paragraph 2(3) allowed that period to be extended by agreement. Section 101 of the Data (Use and Access) Act 2025 omitted both and inserted paragraph 4(A2), under which, within six months of the notice of intent "or as soon as reasonably practicable thereafter," the regulator must give either a penalty notice or written notice that it has decided not to give one.

A penalty notice must allow at least 28 days for payment. A penalty variation notice cannot increase the amount or shorten the payment period, and recovery action cannot begin until any appeal has been decided or the time for appealing has ended. Under section 162, a person given a penalty notice may appeal to the Tribunal against the notice and also "against the amount of the penalty specified in the notice, whether or not the person appeals against the notice."

PECR Penalties Now Run Through the Same Machinery

The fining guidance addresses the UK GDPR and the 2018 Act. Penalties under the Privacy and Electronic Communications Regulations follow a separate statutory route that the 2025 Act redrew. Section 115 of the Data (Use and Access) Act 2025, fully in force since 5 February 2026, substituted regulation 31 so that Schedule 1 to the Regulations applies provisions of Parts 5 to 7 of the 2018 Act "with modifications" for enforcement, and replaced Schedule 1 with the text in Schedule 13 to the 2025 Act.

That schedule applies section 155 and Schedule 16, section 156, section 157 and section 159, among others, each subject to the modifications it sets out. Its paragraph 15 provides that no penalty notice may be given for a failure to comply with regulation 5A, and allows a penalty notice to an officer of a body penalised for breaching any of regulations 19 to 24 in the circumstances it specifies. Section 115 also retains the fixed monetary penalty in regulation 5C for personal data breach notification failures and gives the Secretary of State a power to change its amount by regulations. The modified maxima for PECR are set out in paragraph 18 of Schedule 13 and are not restated here.

Frequently Asked Questions