ICO annual report reveals sharp rise in complaints and personal data breach reports
The Information Commissioner’s Office has published its Annual Report for 2025/26, revealing a significant increase in data protection complaints, personal data breach reports and Freedom of Information complaints received during the year. According to the report, the ICO received 76,743 data protection complaints during 2025/26, compared with 42,315 the previous year, while personal data breach reports increased from 12,412 to 17,431. FOI complaints also rose substantially, reaching 10,713 compared with 7,369 in 2024/25. The regulator said the increase reflects growing public engagement with information rights and its expanding regulatory responsibilities.
The report also highlights a busy year for enforcement activity. Among the most significant actions were fines of £14.47 million against Reddit over children’s privacy failures, £14 million against Capita following a cyber security incident, and £1.23 million against LastPass. The ICO also issued seven reprimands and two enforcement notices during the reporting period.
Elsewhere, the report demonstrates the regulator’s continued focus on online tracking. Through its programme examining the UK’s 1,000 most visited websites, the ICO reported that 979 websites are now compliant with its cookie requirements, while preliminary enforcement notices have been issued to 20 organisations that failed to make the necessary changes.
The report also provides an insight into the ICO’s wider regulatory priorities, including AI, children’s privacy, cyber resilience and public trust in the responsible use of personal information.
A session on ‘Complaint Handling and Other Changes Post-DUAA: Realities of the New Approach’ will take place at PDP’s 25th Annual Data Protection Compliance Conference (23rd, 24th and 25th September). For further details see the website
