A police force is not an obvious source of lessons for a small business, but the ICO's action against the Metropolitan Police Service is about something every organisation does: adopting a new piece of technology because it looks useful.
According to the ICO's findings, published in mid-October 2026, officers and staff at the Met used a third-party retail-crime intelligence platform between March 2023 and September 2024 without the force formally approving it. Press reports name the platform as Auror, a service retailers use to log and share reports of shoplifting. Around 500 free accounts were created and 375 were used for policing. Between January and September 2024, personal information about 179 people, three of them under 18, was uploaded while officers tried to identify suspected shoplifters. For 128 people only a name was uploaded; for 49 a name and date of birth; for two, a home address as well.
The ICO found that the Met processed the information unlawfully, that some sharing was not necessary for law enforcement purposes, that it had not put adequate technical and organisational measures in place, that it had not followed its own assessment and approval processes for third-party technology, and that it had not carried out a data protection impact assessment. It issued a reprimand and an enforcement notice requiring the force to strengthen how it identifies, assesses and approves third-party services, review its controls, raise staff awareness and test regularly whether its measures work.
How it came to light
According to The Register's report, access to the platform was blocked on 26 September 2024 after internal reports in August and September. The force's data protection officer told the ICO in December 2024 and the ICO opened a formal investigation in April 2025. The ICO also noted that officers used the platform for over 18 months without triggering a web-control alert, so the controls had never been shown to work, and that the force relied too heavily on "soft" controls such as policy reminders and training rather than technical blocks.
The Met has accepted that its data protection arrangements were insufficient at the time and says it has tightened its procedures. A force spokesperson said that, after stricter controls and a pilot, the platform is again in use in 14 London boroughs. The ICO's view is that more action is still needed.
David Doodson, the ICO's Head of Investigations, said: "Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it." He added that if you are using new technology to process people's information, you must do so lawfully.
Why this matters beyond policing
The Met's situation will look familiar to a charity using a free survey tool, a retailer trialling a new loyalty app, or a law firm whose staff have started using an AI note-taker. The failure was not a hack. It was an ordinary tool, adopted by well-meaning people, with no gatekeeper.
Five practical lessons
- Make "approved" a real status. Keep a short list of approved tools and make it easy to ask for a new one. If the approval route is slow or unclear, staff will go around it.
- Run the DPIA before launch, not after. A DPIA is a design step. Where a tool involves sharing information about identifiable people with other organisations, treat it as likely high risk and assess it first.
- Check the lawful basis for sharing, not just for collecting. Being allowed to hold information does not mean being allowed to pass it on.
- Rely on technical controls, not just reminders. The ICO's criticism of "soft" controls applies to every organisation. If a tool must not be used, block it, and check the block works.
- Fixing the tool is not the same as fixing the process. Even after the platform was brought back under tighter controls, the ICO still required the Met to improve its wider approach to third-party technology. If you have fixed one incident, ask what in your process allowed it.
A worked example
A small housing charity's team finds a free online tool for sharing photos and notes about tenants' repairs with contractors. It works well, and within weeks 30 staff and 12 contractors have accounts. Nobody carried out a DPIA, there is no contract with the provider and the charity cannot say where the data is stored. A 20-minute check, asking each team which tools they use that were not bought centrally, would have found it in a day. (An invented example, for illustration.)
A 20-minute check for your organisation
Ask three people in different teams which tools they use that you did not buy centrally. Write down the answers. For each, note what personal data goes in, who else can see it, and whether you have a contract and a DPIA. Whatever the list looks like, it is more accurate than the one you had this morning.
Frequently asked questions
What is shadow IT? Software or services used by staff that the organisation has not formally approved or assessed.
Do I always need a DPIA for a new tool? Not always, but you must assess whether processing is likely to result in a high risk. Sharing information about identifiable people with outside organisations is a common trigger.
Is a reprimand serious? It is a formal finding that an organisation breached the law. It carries no fine, but it can come with an enforcement notice, as here, which is legally binding.
Does this apply to private companies? The Met was processing for law enforcement purposes under a different part of data protection law, but the principles of approving tools, assessing risk and checking controls apply to every organisation.
How Pathway 2 Privacy can help: a Policy Review checks that your approval process is clear and workable, a DPIA service assesses the tools you already use, and Data Protection by Design support builds the check into procurement so it stops being an afterthought. See our GDPR support for small businesses and why a supplier breach is still your problem. Or start with a free data protection review.
Sources: The Register, 15 Oct 2026; ITPro, 16 Oct 2026; ICO news release.
