Last updated: 3 October 2026
Short answer: under UK GDPR the ICO can fine a business up to £17.5 million or 4% of annual worldwide turnover, whichever is higher, for the most serious breaches, and up to £8.7 million or 2% for lesser ones. Fines are only part of the cost, because enforcement action, compensation claims and lost client trust often hurt more.
What are the penalties for GDPR non-compliance in the UK?
| Type of penalty | What it means | Typical trigger |
|---|---|---|
| Higher-tier fine | Up to £17.5 million or 4% of annual worldwide turnover. | Breaking core principles, ignoring individuals’ rights, or unlawful data transfers. |
| Standard-tier fine | Up to £8.7 million or 2% of annual worldwide turnover. | Failing on security, record-keeping or breach reporting duties. |
| Enforcement notice | The ICO orders you to change how you handle data, with penalties if you do not. | Persistent or serious compliance failures. |
| Reprimand | A formal public warning, often used for smaller organisations. | Lower-risk failings where harm was limited. |
| Compensation claims | Individuals can claim for damage or distress caused by a breach. | A data breach affecting customers or staff. |
Does GDPR apply to small businesses?
Yes. If you hold personal data about staff, customers or suppliers, UK GDPR applies whatever your size. The ICO considers the nature of the breach, the harm caused and how well you had prepared, so a small business with sensible controls and a clear record is in a very different position from one with none.
How do we reduce our GDPR risk?
- Know what data you holdMap where personal data lives across email, files, Teams, laptops and cloud apps.
- Secure itUse MFA, encryption, access controls and up-to-date devices, as set out in Cyber Essentials.
- Set retentionKeep personal data only as long as you need it, then delete it.
- Be ready for requestsHave a process for subject access requests so you can answer within one month.
- Plan for breachesKnow who decides, who reports and how to meet the 72-hour deadline. See our guide to the first hour after a cyber attack.
Can ABCOM help us stay compliant?
Yes. Compliance is one of ABCOM’s services. We help Sussex businesses secure their data, set up Microsoft Purview labels, data loss prevention and retention, and handle requests such as subject access requests. Book a free IT review to see where you stand.
Sources and further reading
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.