Question

To ask the Secretary of State for Digital, Culture, Media and Sport, if she will make an assessment of the effectiveness of sanctions available against organisations that incur data breaches when systems are found to be inadequate, particularly where sensitive health information is involved.

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the UK's data protection legislation independently of Government. Organisations processing special category data, including health information, must meet additional conditions and safeguards because of the sensitivity of that information. The ICO has powers to issue enforcement notices and substantial monetary penalties where organisations fail to comply with their obligations, including obligations relating to data security.

The Government keeps the effectiveness of the data protection framework under review and recently strengthened the ICO’s investigatory and enforcement powers through the Data (Use and Access) Act 2025.