Remedies under the Data Protection Act 1998


The remedy for breach of the DPA is an enforcement notice issued by the Information Commissioner. An enforcement notice is a legally binding document setting out what an organisation must do (or stop doing) to comply with the law. Since April 2010, the ICO has been empowered to impose fines of up to £500,000. In practice, enforcement notices for data infringement are rare and confined to the most serious cases. 


The House of Commons Justice Select Committee has suggested that the ICO lacks the resources and technical expertise to carry out its functions effectively, while campaign groups Privacy International and Justice have complained that the regulator is failing to investigate complaints properly, even where complaints have support from European partner organisations.


Contact details for the Information Commissioner’s office appear at the end of this booklet. Guidance explaining how to make a complaint are set out on the ICO website (https://ico.org.uk/for-the-public/raising-concerns).