UK's ICO Issues A £14 Million Fine For Poor Data Security – Thoughts For GCs And CISOs

"With so many cyber attacks in the headlines, our message is clear: every organisation, no matter how large, must take proactive steps to keep people's data secure," was the UK Information Commissioner's Office (ICO) message on 15 October 2025 as it issued a £14 million penalty to British outsourcing firm Capita for a data breach relating to a ransomware incident in March 2023.

The breach, which affected Capita employees as well as 325 pension schemes of Capita's clients, resulted in hackers stealing the personal information of 6.6 million people. The ICO's decision provides a detailed roadmap of what large, complex enterprises must do, both as controllers and processors of personal data, to meet their security obligations under data protection laws. For multinational general counsel (GC) and Chief Information Security Officers (CISOs), five themes stand out: (i) system controls preventing lateral movement in the IT estate; (ii) privileged access management; (iii)