# ICO enforcement and regulatory powers > **Key takeaway:** ICO powers: information notices, assessment notices, warnings, reprimands, enforcement notices, penalty notices. Fines: higher tier up to £17.5m/4% global turnover (principles, lawful basis, rights, transfers); lower tier up to £8.7m/2% (administrative duties). Appeal to First-tier Tribunal (Information Rights). - **Jurisdiction:** England & Wales - **Practice area:** Commercial - **Last reviewed:** 2026-09-05 - **Interactive page:** https://www.kttclegal.info/library/notes/Commercial/ico-enforcement-and-regulatory-powers - **Keywords:** ICO, enforcement notice, penalty notice, administrative fine, Article 83, First-tier Tribunal, information notice, assessment notice, UK GDPR ## What is this about? The Information Commissioner's Office (ICO) is the UK's independent data protection regulator, with a graduated set of investigative, corrective, and punitive powers under UK GDPR and the Data Protection Act 2018. The most consequential is the power to issue administrative fines of up to the higher of £17.5 million or 4% of global annual turnover. ## What is the core rule? DPA 2018 Part 5 and 6, read with UK GDPR Arts 57-58, give the ICO investigative powers (information notices requiring disclosure, assessment notices to audit compliance, and entry/inspection warrants) and corrective powers (warnings, reprimands, enforcement notices requiring specific compliance steps, and orders to erase data or restrict processing). Article 83 sets a two-tier maximum penalty structure: the higher tier (up to £17.5 million or 4% of total worldwide annual turnover, whichever is greater) applies to breaches of the core processing principles, lawful basis, data subject rights, and international transfer rules; the lower tier (up to £8.7 million or 2%) applies to breaches of administrative obligations such as record-keeping, DPIAs, and breach notification. Article 83(2) sets out the factors the ICO must weigh in setting a fine, including the nature, gravity and duration of the infringement, whether it was intentional or negligent, and any mitigating action taken. Enforcement notices and penalty notices can be appealed to the First-tier Tribunal (Information Rights). ## What are the elements or test? 1. What power is being exercised — information notice, assessment notice, warning, reprimand, enforcement notice, or penalty notice? 2. Which tier of maximum fine applies — is the alleged breach a core Art 83(5) category (principles, lawful basis, rights, transfers) or an Art 83(4) administrative category? 3. Have the Art 83(2) aggravating/mitigating factors been addressed in any representations to the ICO? 4. Is there a right of appeal to the First-tier Tribunal (Information Rights), and has the relevant time limit been checked? 5. Has the organisation cooperated with any information or assessment notice, or is it liable for separate sanctions for non-cooperation? ## Which authorities matter? - **UK GDPR, Arts 57-58** — Sets the ICO's tasks and its investigative and corrective powers. - **UK GDPR, Art 83** — Establishes the two-tier maximum fine structure and the factors relevant to setting the amount of any fine. - **Data Protection Act 2018, ss.142-154 and Sch.15-16** — The domestic procedural framework for ICO information notices, assessment notices, and penalty notices, including appeal rights. - **Data Protection Act 2018, s.162 (First-tier Tribunal)** — Confers the right to appeal ICO enforcement and penalty notices to the First-tier Tribunal (Information Rights). ## How does this apply in practice? This note covers the structure of ICO powers and penalties, not the ICO's current published fining guidance or specific past decisions, which should be checked directly for up-to-date practice. It does not address parallel criminal offences under DPA 2018 (e.g. unlawfully obtaining personal data, s.170), which are prosecuted rather than dealt with by administrative fine. ## What are common pitfalls? - Assuming every breach automatically attracts the higher-tier maximum fine — the actual fine reflects the Art 83(2) factors and is very rarely the statutory maximum - Ignoring an ICO information or assessment notice, which can itself expose the organisation to further sanction - Missing the time limit to appeal an enforcement or penalty notice to the First-tier Tribunal - Conflating a reprimand (a lower-severity corrective measure) with a formal penalty notice - Overlooking that cooperation, prompt remediation, and prior compliance history are material to the fine ultimately imposed ## When would a practitioner use this? Relevant when advising a controller or processor facing ICO investigation, information/assessment notices, or a proposed enforcement or penalty notice, and in risk-assessing potential exposure following a known compliance failure. ## Quick reference ICO powers: information notices, assessment notices, warnings, reprimands, enforcement notices, penalty notices. Fines: higher tier up to £17.5m/4% global turnover (principles, lawful basis, rights, transfers); lower tier up to £8.7m/2% (administrative duties). Appeal to First-tier Tribunal (Information Rights). --- *Reference material from [KTTC Legal](https://www.kttclegal.info/), not legal advice. Work product supports instructing solicitors and barristers under their supervision. England & Wales.*