ICO publishes annual 2024-25 annual report

The Information Commissioner's Office (ICO) has published its annual report and financial statements for the 2024-25 period. The report outlines the ICO's efforts to deliver four key strategic objectives, including upholding information rights, empowering responsible innovation, promoting transparency, and providing impactful regulatory outcomes. 

Over the period, the ICO received 42,315 data protection complaints, of which only 30% were responded to within 90 days, a significant decrease from 84.8% in the previous period. The ICO confirmed that 98.4% of these complaints were resolved within 6 months and that only 0.1% were over 12 months old. 

In addition, the ICO received 12,412 personal data breach reports, of which 83.7% were referred or closed within 30 days, up from 72.7% in the previous year. However, the percentage of data breach reports over 12 months old increased from zero to 25.3%.

In terms of public sector transparency, the ICO received 7,639 FOI complaints, of which 94.8% were responded to within 6 months, slightly down from 95.5% in the previous period. Only 0.3% of complaints were over 12 months old, up from 0.1%.  

Reporting on its regulatory enforcement activities, the ICO issued 9 reprimands, 2 UK General Data Protection Regulation (GDPR) penalty notices totalling £3,826,320, 9 monetary penalty notices totalling £890,000 and 9 enforcement notices under the Privacy and Electronic Communications Regulations (PECR). The ICO also contacted 93 organisations about website cookies, completed 15 investigations and managed 61 cyber incidents in the year.