Data protection used to be a corporate risk. In 2026 it is becoming a personal one.
Most directors and senior leaders assume that if their organisation faces an ICO investigation, the fine lands on the company. Not on them personally.
That assumption is increasingly worth questioning.
What the law actually says
Under the Data Protection Act 2018, individuals can be held personally liable for data protection offences including unlawfully obtaining personal data, altering records to prevent disclosure, and re-identifying anonymised data. Where a company commits an offence with the consent or connivance of a director, or because of their neglect, section 198 of the Act means the director can be guilty of it too.
Beyond criminal liability, the ICO has the power to hold senior individuals accountable where organisational failures stem from decisions made at board level. Legal commentary in 2026 has consistently described personal liability for directors as a deepening part of the enforcement landscape.
What is driving this
- Fines are getting larger and the ICO is getting more targeted. It is taking fewer enforcement actions, but issuing much bigger fines, particularly for security failures.
- The Capita fine of £14 million pointed to failures in how security was managed and resourced, not just the technical cause of the attack.
- Across Europe, regulators are increasingly exploring whether to hold individual executives personally liable. The Dutch DPA investigated personal liability for management in the Clearview AI case. UK regulators are watching.
- The Cyber Security and Resilience Bill, now in its final stages in Parliament, will extend reporting obligations and governance requirements, increasing the personal accountability of those who sign off on data protection decisions.
What this means in practice
If a board makes a decision to cut security budgets, delay a DPIA, or override data protection advice and a breach follows, the ICO's investigation will look at who made that decision and why.
Documented governance. Board level sign off on data protection risk. Evidence that senior leaders engaged with compliance and understood the risks.
These are no longer just good practice. They are your personal protection.
As a senior leader, how confident are you that data protection decisions in your organisation are being documented at board level? A data protection audit or an outsourced DPO can give your board an independent view, or you can start with a free data protection review.
