Post-GDPR regulatory enforcement of UK data protection: reality, scrutiny, oversight and future

The General Data Protection Regulation and associated legal reforms in 2018 promised strong regulatory enforcement secured primarily through comprehensive and dissuasive fines. Although this law has largely continued post-Brexit, UK regulatory realities have been starkly - and generally increasingly – different. Despite receiving a yearly average of over 43,000 complaints alleging data protection infringement, the Information Commissioner’s Office (ICO) issued an average of just 6.8 fines each year from 2018/19 to 2025/26. There were also just 1.8 enforcement notice actions per year since 2018/19 which highlights a lack of robust appropriate measures compensating for fines paucity. Effective scrutiny of individual ICO decisions has not been secured through the Tribunal, the Ombudsman or the High Court. The ICO’s parliamentary oversight committee has, in general, also failed to ensure systematic holistic accountability and the Equality and Human Rights Commission has entirely avoided addressing enforcement issues. Notably by placing the ICO under a range of new duties which sit in tension with data protection, the Data (Use and Access) Act may exacerbate current realities. Nevertheless, following revelation of the 2022 Afghan data breach and the absence of ICO investigation, the Science, Innovation and Technology Committee committed to securing enhanced oversight. Turning to granular scrutiny, UK case law has also affirmed that the Tribunal must objectively and independently ensure the appropriateness of ICO investigations of complaints and, in relation to judicial review, persuasive Court of Justice case law has enunciated a far-reaching lawfulness obligation of supervisory authorities to respond to infringements through use of formal corrective powers other than in truly exceptional and enumerated situations. However, it remains doubtful whether these developments will dislodge the low enforcement trajectory which UK data protection regulation is on.