United Kingdom：数据保护法、网络犯罪、罚款与刑罚
UK GDPR enforced by the ICO, with recent fines over age assurance and ransomware; the DUAA 2025 raised the PECR cap to the UK GDPR level.
- Law
- UK GDPR + Data (Use and Access) Act 2025
- Authority
- ICO (Information Commissioner's Office)
- Max fine
- £17.5M or 4% (UK GDPR; extended to PECR by the DUAA)
- Breach notification
- —
- DPO
- —
Crimes
| Unauthorised access | Computer Misuse Act 1990, s.1 | Up to 2 years |
| Access with intent to commit further offences | Computer Misuse Act 1990, s.2 | Up to 5 years |
| Impairing a computer (e.g. ransomware) | Computer Misuse Act 1990, s.3 | Up to 10 years |
| Serious damage to infrastructure | Computer Misuse Act 1990, s.3ZA | Up to life imprisonment |
| Fraud by false representation (phishing) | Fraud Act 2006, s.2 | Up to 10 years |
Risks
- Age assurance and children's data (Reddit, £14.47M, Feb 2026)
- Ransomware in essential services (South Staffordshire Water, £963.9k)
- PECR (cookies and marketing) with a cap raised by the DUAA
- Data (Use and Access) Act 2025: Royal Assent on 19 Jun 2025, phased commencement through 2026
- Historic ICO fines: British Airways £20M and Marriott £18.4M (2020)
来源: Skillcast – maiores multas do ICO · GDPR Local – Top 2026 · legislation.gov.uk – CMA 1990 · legislation.gov.uk – DUAA 2025