United Kingdom: Information Commissioner’s Office opened consultation on Data Protection Enforcement Procedural Guidance

On 31 October 2025, the Information Commissioner’s Office (ICO) opened a consultation on the Draft Data Protection Enforcement Procedural Guidance under the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (GDPR), until 23 January 2026. The consultation concerns statutory guidance describing the scope, status, and use of the ICO’s investigatory and enforcement powers, including decision-making when opening investigations, information gathering through information notices, assessment notices, interview notices, and powers of entry and inspection, as well as the process for warnings, reprimands, enforcement notices, and penalty notices. The draft guidance outlines considerations such as harm to data subjects, proportionality, prioritisation, and cooperation obligations, and includes statutory references to Articles 57–58 UK GDPR and Part 6 DPA 2018. It also addresses publication of enforcement actions, settlement procedures, and rights of appeal to the Tribunal.