UK ICO Enforcement Actions

Search the UK Information Commissioner's Office enforcement register for monetary penalties, reprimands, enforcement notices and prosecutions under UK GDPR, PECR and the Data Protection Act 2018.

🏛️ What is the official way to read ICO enforcement actions?

The ICO publishes its actions on the enforcement register, a filterable list on ico.org.uk served 25 actions to a page. It is a good register: filters for type, sector and date all work, and every action links to a detail page. What it does not offer is any export, download or documented API for the enforcement data, so building a fine trend by sector, or a list of every organisation reprimanded this year, means clicking through pages and copying by hand.

This Actor reads the same register and returns each action as a row: organisation, action type, fine amount as both the published string and a plain number, sector, date and the detail link. Filters are applied server side by the ICO's own search, so a filtered run returns exactly what the site would show, just as data you can sort, join and schedule.

🔍 What does UK ICO Enforcement Actions do?

It searches the official ICO enforcement register at ico.org.uk and returns every matching action as a clean row of data, ready for a spreadsheet, a database or your own compliance tooling.

• Filters by enforcement type: fines, reprimands, notices and prosecutions
• Filters by sector, for example health, finance, tech or government
• Filters by date range
• Keyword search for organisations or breach types
• Paginates automatically through result pages

📊 What data can I extract from the ICO?

One row per enforcement action:

	Field	Description
🏢	01_organisation	Company or entity name
🏷️	02_title	Enforcement action title as the ICO published it
⚖️	03_enforcementType	Monetary penalty, Reprimand, Enforcement notice or Prosecution
💷	04_fineAmount	Fine amount as published, for example "£14,472,500", where one applies
🗂️	05_sector	Industry sector, for example Health, Finance or Criminal justice
📅	06_date	Date of the enforcement action
📝	07_summary	Details of the breach and the ICO's reasoning
🔗	08_detailsUrl	Link to the full enforcement notice
💷	fineAmountGbp	Fine as a plain number, for sorting and thresholds
📅	dateGranularity	Whether the date is a published day or only a month read from the URL
📅	retrievedAt	When this run read the register

Column names carry numeric prefixes so exports and previews keep the right order.

💡 Why scrape ICO enforcement actions?

DPO briefings. A data protection officer pulling every action in their sector from the last twelve months, so the board pack shows what the ICO actually fined rather than what the headlines said.

Consultancy evidence. A GDPR consultant building a trend report of fines by sector and breach type, with fineAmountGbp as a sortable number instead of a screenshot of the register.

Security sales. A security vendor tracking the technical failures the ICO names in its summaries, such as missing MFA or weak incident response, and mapping them to what they sell.

Underwriting checks. A cyber insurance analyst checking whether an applicant, or anyone in their group, appears on the enforcement register before quoting.

Marketing compliance. A firm buying marketing lists checking recent PECR prosecutions and penalties for unsolicited calls and texts, which are the most common actions on the register.

Journalism and research. A reporter following how enforcement policy shifts over time, and which sectors carry it, from several years of actions in one dataset.

🚀 How do I use UK ICO Enforcement Actions?

1. Click Try for free.
2. Put an organisation name or breach type into keywords, for example health.
3. Narrow it with enforcementType, sector, dateFrom and dateTo.
4. Set maxResults to cap the run.
5. Click Start, then download the results as JSON, CSV or Excel, or pull them from the API.

⬇️ Input

{
  "keywords": "health",
  "maxResults": 100
}

Field	Type	Default	What it does
keywords	string		Keyword search for organisations or breach types
enforcementType	array		Filter by enforcement type, fines, reprimands, notices or prosecutions
sector	array		Filter by sector, health, finance, tech, government and so on
dateFrom	string		Only actions on or after this date
dateTo	string		Only actions on or before this date
maxResults	integer	100	Hard cap on billable results

⬆️ Output

Table view

Results arrive as an Actions table you can sort and filter in the Console, with the organisation, enforcement type, fine amount and date lined up for scanning.

JSON

A typical row:

{
  "01_organisation": "Metropolitan Police Service",
  "02_title": "Metropolitan Police Service reprimand",
  "03_enforcementType": "Reprimands",
  "04_fineAmount": null,
  "05_sector": "Criminal justice",
  "06_date": "2026-07-27",
  "07_summary": "Incident 1 (ICO Ref: INV/0034/2025), concerning the service of unredacted documents...",
  "08_detailsUrl": "https://ico.org.uk/action-weve-taken/enforcement/2026/07/metropolitan-police-service-reprimand/",
  "fineAmountGbp": null,
  "dateGranularity": "day",
  "retrievedAt": "2026-08-17T09:12:44.000Z"
}

A reprimand carries no fine, so 04_fineAmount and fineAmountGbp are null rather than zero. On a monetary penalty they hold the published figure, for example "£14,472,500" and 14472500.

Download it from the run as JSON, CSV or Excel, or read it straight from the API.

Enforcement types explained

Monetary Penalty, financial fines up to £17.5 million or 4% of global turnover for serious GDPR breaches. Typically reserved for major data breaches, systemic failures or reckless behaviour.

Reprimand, formal written warning for GDPR violations. Often used for public sector organisations instead of fines, or for first-time offenders who cooperate.

Enforcement Notice, legal order requiring an organisation to take, or stop, specific actions to comply with data protection law. Non-compliance can lead to prosecution.

Prosecution, criminal proceedings for serious offences such as unlawfully obtaining or disclosing personal data, obstructing ICO investigations, or failing to pay data protection fees.

Sector coverage

The ICO enforces across all UK sectors:

• Central and local government
• Health and social care
• Finance, insurance and credit
• Education and childcare
• Online technology and telecoms
• Marketing
• Retail and manufacturing
• Legal services
• Charitable and voluntary
• Criminal justice
• Media
• Transport and leisure
• Utilities
• Regulators

Notes on the data

• ICO enforcement data dates back several years
• Large fines are often negotiated down from the initial amount, so check 08_detailsUrl for the settled position
• Public sector organisations typically receive reprimands rather than fines
• PECR violations, meaning spam and marketing, are more common than GDPR breaches but carry smaller fines
• The register is updated continuously as new actions are published
• A typical run for 100 results takes 60 to 120 seconds, depending on filters, and is rate limited to respect ICO servers

⏱️ How long does a run take?

Measured on real runs, so you know what normal looks like and can tell it apart from a run that has stalled.

Actions returned	Typical run time
25	about 5 seconds
100	about 10 seconds
220	about 25 seconds

The ICO register serves 25 actions to a page and the Actor reads one page at a time, so the run time tracks the number of actions almost exactly, at roughly a tenth of a second each. Filters for type, sector and date are applied by the ICO's own search rather than after the fact, so a filtered run is faster than an unfiltered one, not slower. The first few seconds of any run are the container starting rather than the work.

A run is never silently stuck. Each page of the register is logged as it is read, and actions are written to the dataset as they are parsed rather than held back to the end, so a run that hits its time limit still leaves everything it had already collected. A filter that matches nothing ends successfully with an empty dataset and the reason in its status message.

Set the run timeout to suit the size of the ask. This Actor's default is 3600 seconds, which is comfortably more than the largest run in the table above (1,000 actions takes about 3 minutes). You are charged per delivered result rather than per minute, so a generous timeout costs you nothing and a tight one risks losing the run's work. Lower it only if you want a hard ceiling on how long a scheduled run may sit.

💰 How much does it cost?

$0.001 per enforcement action returned, plus the standard $0.00005 Apify charges once when a run starts. There is no monthly rental, so you pay only for what a run actually returns.

So a typical run that returns 100 actions costs $0.10005. A weekly monitoring run with a recent dateFrom that picks up 5 new actions costs $0.00505, and a pull of 500 actions costs $0.50005. A run that finds nothing new costs $0.00005.

Paid Apify plans pay less per action: $0.00085 on Bronze, $0.0007 on Silver, $0.0006 on Gold, $0.0005 on Platinum and $0.0004 on Diamond, which is 40 percent of the list price. That 500 action pull is $0.20005 on Diamond.

Set maxResults to cap what a run can cost before it starts. The Apify listing always shows the current rates.

🔌 Integrations

Send results straight to Google Sheets, Slack, Airtable, Zapier, Make or your own webhook using Apify integrations. You can also trigger a run whenever something happens in another tool.

AI agents can call this Actor through the Apify MCP server. An agent connected to mcp.apify.com can discover spookyweb/uk-ico-enforcement-actions, pass keywords, an enforcement type, a sector and a date range as tool arguments, and receive the actions back as structured rows. That lets an agent answer "has the ICO taken action against this organisation" from the live register, without custom API code.

🔗 Using UK ICO Enforcement Actions with the Apify API

curl -X POST "https://api.apify.com/v2/acts/spookyweb~uk-ico-enforcement-actions/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": "health", "maxResults": 100}'

Or with the Apify client:

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_TOKEN' });
const run = await client.actor('spookyweb/uk-ico-enforcement-actions').call({
  keywords: 'health',
  maxResults: 100,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();

Full detail is in the Apify API reference, and every run is also callable from the Python and JavaScript clients.

❓ FAQ

What kinds of action are covered?

Four: monetary penalties, reprimands, enforcement notices and prosecutions. Use enforcementType to keep only the ones you want, and see the enforcement types section above for what each one actually means.

Does it give the fine amount?

Yes, in 04_fineAmount, where the action carries one. Reprimands and enforcement notices usually have no figure, so that field is null on them rather than a guess. Remember that large fines are often negotiated down from the initial announcement, so check 08_detailsUrl for the settled amount.

Can I filter by sector?

Yes, sector takes one or more of the sectors listed above, for example health or finance. Combine it with dateFrom to see how enforcement in one sector has moved over time.

How far back does it go?

The register holds several years of enforcement. Leave dateFrom empty to take everything the ICO publishes, or set it to bound a run to the period you actually need.

How soon do new actions appear?

The Actor reads the live ICO register, so an action is available as soon as the ICO publishes it. Schedule a daily or weekly run with a recent dateFrom and a low maxResults to pick up new items without re-collecting the archive.

Can I use the data commercially?

Yes. ICO enforcement data is published under the Open Government Licence v3.0, which permits commercial use with attribution. Attribution: Contains public sector information licensed under the Open Government Licence v3.0.

⚖️ Is it legal to scrape ICO enforcement actions?

The ICO publishes its enforcement actions itself, as a public record of regulatory decisions. These concern organisations and their data protection failures. This Actor reads only the ICO's own published pages, and it never logs in.

Data comes from the ICO Enforcement Register under the Open Government Licence v3.0. Apify's ethical scraping guide covers the wider picture.

👍 Your feedback

Found a bug, or want a field that is not here yet? Open an issue on the Actor's Issues tab. Requests that make the data more useful get built, and problems get fixed quickly.

🔎 You might also like

Actor	What it does
UK FCA Enforcement Notices	FCA final, decision and warning notices with firm names and penalty amounts
UK Financial Ombudsman Decisions	Final FOS decisions filterable by business, sector and outcome, with PDF links
UK Case Law Search and Monitor	Court judgments and tribunal decisions from Find Case Law, with full text and change monitoring