Skip to main content
Cybersecurity Statistics

Cybersecurity statistics

In 2024, 3 public organisations were fined by the Information Commissioner’s Office (ICO): The Police Service of Northern Ireland (PSNI) was fined £750,000, the Ministry of Defence (MOD) was fined £350,000 (reduced from £1m), and the Central YMCA was fined £7,500.

PublisherURM
ReportAnalysis of Fines Imposed by the Information Commissioner’s Office in 2024
Published1 February 2025

Published by URM in Analysis of Fines Imposed by the Information Commissioner’s Office in 2024 , 1 February 2025. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Fines for breaches of PECR exceeded those for UK GDPR violations, with roughly £1.6m compared to around £1.1m.
URM, 01/02/2025
There were 62 instances of enforcement action against 47 organisations by the Information Commissioner’s Office (ICO) in 2024, including 8 law enforcement agencies. 32 of these actions related to breaches of the UK GDPR and were brought against 31 organisations, with 27 in the public sector and 4 in the private sector.
URM, 01/02/2025
The ICO imposed 18 monetary penalties in 2024, nearly the same as the 17 in 2023.
URM, 01/02/2025
The average fine by the Information Commissioner’s Office (ICO) in the UK in 2024 was £153,722, which is less than a fifth of the 2023 average of £816,471 (skewed by a large fine to TikTok).
URM, 01/02/2025
The majority of fines by the Information Commissioner’s Office (ICO) in 2024 were for breaches of the Privacy and Electronic Communications Regulations (PECR), but the proportion of fines for UK GDPR breaches rose to one sixth of the total in 2024, compared to one seventeenth in 2023.
URM, 01/02/2025

Get the newsletter

Weekly cybersecurity statistics by email.