GDPR fines in the UK: what businesses need to know

For breaking the core rules, UK GDPR fines can reach £17.5 million or 4% of a business's worldwide annual turnover, whichever is higher. Other breaches carry a maximum of £8.7 million or 2%. These are the highest UK GDPR fines the law allows. Each fine depends on the circumstances of the case, and the regulator can use other measures instead.

How much can a GDPR fine be in the UK?

It depends on the rule you break, because the law sets a standard maximum and a higher one. Both are defined in section 157 of the Data Protection Act.

Standard and higher maximum GDPR fines in the UK

Turnover means a business's total worldwide turnover in the previous financial year. The law calls a business an undertaking, a word you may see in official guidance. Sometimes the same or linked things you do with personal data break several rules. The total fine then can't be higher than the maximum for the worst of those breaches.

Which laws the fines come from

The UK GDPR and the DPA 2018, the Data Protection Act 2018, together set the rules for using personal data in the UK. Our guide to GDPR explains the basics.

The Privacy and Electronic Communications Regulations (PECR) cover electronic marketing, such as marketing emails, and the use of cookies on websites. The Data (Use and Access) Act brought their enforcement powers and fines in line with the Data Protection Act 2018. These changes came into force on 5 February 2026. So a breach of these rules can now carry the same maximum fines.

If you offer goods or services to people in the EU, the EU's own GDPR can apply to you as well. It has its own maximum fines.

Who issues fines and what else they can do

In the UK, the Information Commission issues fines. It took over the work of the Information Commissioner's Office (ICO) on 30 September 2026, so older guidance and news still name the ICO.

Besides a fine, the regulator can give you a warning or a reprimand. It can also order you to bring your use of personal data in line with the law. It can limit or ban some of that use too, for a time or for good. A fine can come on top of these measures or instead of them. If you ignore one of the regulator's orders, that breach falls under the higher maximum. For an overview, see NI Business Info's guide to data protection penalties.

How the amount of a fine is decided

The law lists what the regulator must take into account when it sets a fine for a breach of data protection law, including:

• How serious the breach was, how long it lasted, how many people it affected and how much harm it did.
• Whether it was deliberate or careless.
• What you did to limit the harm to the people affected.
• The security measures you had in place, and any earlier breaches.
• The kind of data involved, such as health data.
• Whether you notified the regulator about the breach yourself.
• How well you worked with the regulator.

Four of these are in your own hands: limiting the harm, the security you have in place, reporting a breach yourself and working with the regulator.

Examples of GDPR fines

Two big UK data breach fines followed attacks on large companies, and a third came from the EU:

• British Airways was fined £20 million after a cyber attack in which attackers collected personal and card details of more than 400,000 customers. Security measures such as multi-factor authentication were missing at the time, and the ICO had first said it intended to fine £183 million.
• Marriott International was fined £18.4 million over an attack that began in 2014 at Starwood, a hotel group Marriott bought two years later. The attack went unnoticed until 2018 and may have affected up to 339 million guests, and the ICO found that Marriott had not protected the data well enough.
• Meta was fined more than €1 billion in May 2023 by the Irish Data Protection Commission over the way it moved personal data of Facebook users in the EU and EEA to the US. The fine came under the EU's GDPR, so it shows what the EU rules can mean for a business with customers there.

You can look up other cases in the GDPR Enforcement Tracker, which lists GDPR fines, UK GDPR fines included.

Can small businesses and individuals be fined?

Yes. GDPR fines apply to small businesses, sole traders and individuals as well as large companies. The maximum for a business depends on its turnover, not its size. For anyone who isn't a business, such as an individual running a club, the maximum is the fixed amount in the table. UK GDPR doesn't apply to an individual's purely personal or household use of data. For a small business or sole trader, 4% or 2% of turnover comes out below the fixed sum, so the fixed sum is the ceiling. At a turnover of £5 million, for example, 4% is £200,000, far below £17.5 million.

From a contact form to an online shop, any form that asks for a name collects personal data. So the everyday tasks of a small website deserve as much care as protection against a hack, especially these:

• Sending newsletters and other email marketing, or marketing texts, to people who haven't agreed to receive them.
• Setting cookies that need consent before visitors have given it.
• Ignoring a customer who asks for a copy of their data or asks you to delete it.

How to avoid a GDPR fine

These habits help a small website stay on the right side of the rules:

• Don't collect more than you need. Leave out any question you don't need answered.
• Tell people what you do with their data. Your privacy policy should say what you collect, why, how long you keep it and who you share it with.
• Ask before you set cookies that need consent or send marketing, unless you're emailing existing customers about similar products and gave them an easy way to say no. Use a cookie banner that lets visitors say no, use consent management to keep a record of who agreed to your emails and when, and let customers say no when you collect their details and in every email.
• Keep the data secure. Use strong passwords and two-factor authentication, keep your website software up to date, and limit who can see customer data.
• Answer requests about personal data within one month. When people ask for a copy of their data, or ask you to correct or delete it, make sure someone sees the request and answers it without undue delay; for complex or many requests, you can take two more months if you tell them why within the first month.
• Know which breaches to report. If a breach is likely to put people at risk, you must tell the regulator without undue delay and, where you can, within 72 hours of finding out. Keep a record of every breach, including the ones you don't need to report.

When you report a breach, have the details ready: what happened, which data and roughly how many people it affects. Say too what it's likely to mean for them, what you're doing about it and who the regulator can contact for more. Where the risk to the people affected is high, you must tell them too, without undue delay.

A tool such as Termly for website compliance & cookie consent helps with the paperwork, but no tool knows what you do with data. What you collect, who can see it and how you answer requests is still up to you.

Termly scans your website for cookies and creates your privacy policy and cookie banner.

Start with your privacy policy and cookie consent

You don't have to fix everything at once. Start with what every visitor sees, your privacy policy and your cookie banner, because they also show customers that you take their data seriously. Add Termly to your website, then work through the other habits above one at a time.