The ICO Picked Reprimands Over Fines, and Two Landed in One Month

What the ICO actually did, and to whom#

A fox does not need to catch every rabbit in the hedgerow to prove the hedgerow is dangerous. It only needs to catch one, cleanly, in view of every other rabbit watching. That is roughly what the UK's Information Commissioner's Office did twice this August, and the pattern matters more than either single case.

On 14 August 2026, PublicTechnology reported that the ICO had reprimanded ACRO Criminal Records Office, the body that processes criminal-record checks for employers, visa applicants and international travel. The ICO's own reprimand, dated 7 August 2026, is more specific than the headline: a hacker held unauthorised access to ACRO's content management system for seven months, between August 2022 and March 2023, before anyone noticed. Up to 10,920 people had data exposed, including National Insurance numbers and, for some, biometric and criminal-offence information. The regulator found ACRO in breach of Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR, the security-of-processing provisions that ask a controller to actually operate the protections it says it has.

The second case is quieter but sits in the same file. The Metropolitan Police Service was issued an enforcement notice and a reprimand earlier in August, this time for two separate incidents: unredacted court documents that exposed a stalking victim's new address and phone number, and a bulk email sent with recipients visible to one another in the "To" field, exposing eighteen people connected to a parliamentary matter. Both breach section 40 of the Data Protection Act 2018, the law-enforcement processing regime that sits alongside UK GDPR. The enforcement notice gives the Met three months to fix the immediate gap and twelve to close the rest.

Two cases, one instrument#

Neither ACRO nor the Met Police was fined. That is not the ICO going soft, it is the ICO choosing its tool deliberately, and the choice is the actual story here for anyone selling into data protection compliance.

That reaction, from a working CISO commentator rather than a journalist, names the real failure mode precisely: ACRO had alerting tools running and simply was not reading them. It is the kind of governance gap a fox would spot from the tree line before it ever became a breach, the mismatch between equipment purchased and behaviour practised.

Why reprimands, not fines, are doing the work#

If you sell, market or advise on data protection compliance, the instinct is to track fines. Fines make headlines and headlines make case studies. But an analysis of the ICO's full public enforcement register, run by Bridewell and reported by Compare the Cloud, shows the regulator's actual instrument of choice between 2023 and May 2026: 65 reprimands, 58 monetary penalties and 49 enforcement notices.

A reprimand costs an organisation nothing in direct fees. It costs something else: a permanent, public, dated entry naming exactly which article of UK GDPR was breached and why, sitting on the regulator's own website for as long as the ICO chooses to keep it there. For a security vendor or GRC platform selling data protection compliance services, that public record is more useful marketing evidence than a fine, because it names the specific control gap rather than a headline number.

This is the shift a genuine data protection compliance framework has to account for now. A programme built only to survive an audit that ends in a monetary penalty is built for the wrong regulator behaviour. The one that actually lands, more often than not, is a named, published reprimand that a client, a journalist or a competitor can read in full within a day of release.

What actually broke, in both cases#

Read past the headline in each case and the failures are almost boringly ordinary, which is exactly why they are worth studying. ACRO's content management system stayed unpatched through the entire seven-month intrusion window. The alerts existed. Nobody triaged them. The Met Police's failures were procedural rather than technical: a document sent unredacted, an email sent with the wrong field carrying recipient addresses.

The second version is the one a genuine data protection compliance framework produces, and it is the one an auditor, a regulator or a prospective client can actually verify. ACRO's reprimand names precisely this gap: security tooling present, security tooling unoperated. That distinction, tooling versus operation, is where most vendors selling into GRC compliance software undersell their own product, because the pitch stops at the tool rather than the discipline that runs it.

Selling GDPR compliance services without the theatre#

Every GRC vendor and security consultancy currently pitching gdpr compliance services has two ACRO-shaped case studies handed to them this month, and most will waste both by leading with fear rather than with the specific, checkable gap the ICO actually named.

The trap is well worn. A vendor reads "seven months undetected" and reaches for a slide about advanced persistent threats, when the ICO's own reprimand says the opposite: this was not sophisticated. It was an unpatched system and unread alerts. Marketing that mismatches the sophistication of the threat to the plainness of the failure loses credibility with exactly the buyer who reads the primary source, which any competent GRC lead will.

The same discipline applies to soc 2 compliance services, a nearby but distinct sale. The AICPA's own description of SOC 2 scopes it to five trust service categories: security, availability, processing integrity, confidentiality and privacy, assessed over a defined review period. A UK GDPR reprimand asks a different, wider question: whether personal data was actually protected in practice, continuously, not just during the window an auditor happened to be watching.

ACRO's case is a useful teaching example precisely because it shows how an organisation can hold both correctly on paper, and still fail the second test if operational discipline lapses between formal reviews. Selling soc 2 compliance services on the back of this story only works if the pitch is honest about that gap, not if it implies a SOC 2 badge alone would have stopped ACRO's intrusion.

For agencies and in-house teams marketing data protection compliance work, the practical move is narrower than most pitches allow: name the specific article breached, name the specific fix, and resist the urge to inflate a patching failure into a sophisticated-attacker story. The ICO already published the honest version. Competing with it by exaggerating only reads as marketing rather than expertise.

Building a data protection compliance framework that survives a reprimand test#

A data protection compliance framework built to survive a fine is not the same shape as one built to survive a reprimand, because a reprimand tests operational discipline over months, not paperwork at a single audit point. ACRO's gap sat open for seven months. A framework that only gets exercised at renewal time will not catch that.

That last step is the one most compliance functions skip, and it is the cheapest. The ICO's enforcement register is public, dated, and increasingly the clearest evidence base available for what a UK regulator actually checks, ahead of what a certification body's marketing implies it checks.

Third-party risk sits underneath all of this too. ACRO processes data on behalf of employers and visa authorities; the Met Police case touched documents shared with external parties. Any data protection compliance framework that stops at an organisation's own perimeter misses exactly the failure both August cases share: data moving to or through a process that was not being watched closely enough.

None of this is buried in obscure guidance. Article 32(1) of the UK GDPR itself asks controllers to take "appropriate technical and organisational measures" that account for the state of the art, the cost of implementation, and the actual risk to people whose data is processed. That is not a checklist, it is an ongoing judgement call.

That is exactly why a framework tested once a year misses a gap that opens in month two and closes in month nine, precisely ACRO's timeline. The Metropolitan Police case sits under a related but distinct duty, section 40 of the Data Protection Act 2018, the sixth law-enforcement processing principle, which requires "appropriate security" for data processed for policing purposes specifically.

The ICO publishes its own expectations for what "appropriate" looks like on its security guidance pages, and the UK's National Cyber Security Centre publishes the operational half of the same problem in its vulnerability management guidance, which frames patching as "business as usual" rather than an exceptional, on-demand task, precisely the discipline ACRO's reprimand shows was missing. A vendor selling into this space that cannot point a prospective client at both of these free, public documents is selling confidence rather than competence.

The full pattern is there for anyone who reads the register rather than the headlines. The ICO keeps a running, public list of every case it has taken action on at its enforcement action page, and a genuine data protection compliance framework treats that page as a live threat model, not an archive to skim once a quarter out of professional obligation.

Frequently asked questions#