Private Law Theory

ABSTRACT
The General Data Protection Regulation and associated legal reforms in 2018 promised strong regulatory enforcement secured primarily through comprehensive and dissuasive fines. Although this law has largely continued post-Brexit, UK regulatory realities are starkly – and generally increasingly – different. Despite receiving a yearly average of nearly 40,000 complaints alleging data protection infringement, the Information Commissioner’s Office (ICO) issued an average of just 6.6 fines each year from 2018/19 to 2024/25. In 2024/25 itself this figure was just 2 and totalled a mere £3.8m. There were also zero enforcement notice actions in 2024/25 and, on average, only 1.7 such actions since 2018/19 which highlights a lack of robust appropriate measures compensating for limited fines. Effective scrutiny of individual ICO decisions has not been secured through the Tribunal, the Ombudsman or the High Court. The ICO’s parliamentary oversight committee has, in general, also failed to ensure systematic holistic accountability and the Equality and Human Rights Commission has entirely avoided addressing enforcement issues. Notably by placing the ICO under a range of new duties which sit in tension with data protection, the Data (Use and Access) Act may exacerbate current realities. Nevertheless, following revelation of the 2022 Afghan data breach and the absence of ICO investigation, the Science, Innovation and Technology Committee has committed to securing enhanced accountability. The Ombudsman has also indicated that the ICO must respond to complaints with, at least, a probabilistic assessment of compliance. Finally, UK case law has affirmed that the Tribunal must objectively and independently ensure the appropriateness of ICO investigations of complaints and, in relation to judicial review, persuasive Court of Justice case law has enunciated a far-reaching lawfulness obligation of supervisory authorities to respond to infringements through use of formal corrective powers other than in truly exceptional and enumerated situations.

Erdos, David, Post-GDPR Regulatory Enforcement of UK Data Protection: Reality, Scrutiny, Oversight and Future (February 16, 2026).