Your supplier had a breach. Your customers are affected. Under UK GDPR, that is your problem.
Supply chain data risk is one of the fastest growing and least managed areas of data protection compliance in the UK. Most organisations now rely on a long list of suppliers that handle personal data for them, from payroll and HR systems to IT support, cloud storage and marketing platforms. And the ICO has made it very clear where the responsibility sits.
What the law says
Under UK GDPR, as the data controller you remain legally responsible for the personal data you share with third party suppliers. If your supplier suffers a breach, is fined, or fails to meet their obligations, your organisation does not escape liability by pointing at them.
You chose the supplier. You shared the data. You are accountable.
What the enforcement tells us
Advanced Computer Software Group was fined £3.07 million in 2025 as a data processor after a ransomware attack disrupted NHS services and put the personal data of nearly 80,000 people at risk. The attack exploited a single customer account without multi-factor authentication. This was the ICO's first major fine directly against a processor.
Capita was fined £14 million in October 2025 for cybersecurity failures that exposed the data of 6.6 million people. A security alert was raised within minutes of the attack, but the affected device was not isolated for 58 hours, giving the attacker time to move through the network and take data.
In both cases the ICO's investigation looked beyond the immediate cause of the breach to the contractual and governance arrangements between controllers and processors.
What most organisations are missing
- No Data Processing Agreement in place with key suppliers.
- No due diligence carried out on supplier security standards before onboarding.
- No contractual obligation on suppliers to notify of a breach quickly.
- No visibility of whether suppliers are using sub-processors to handle your data.
- No review of supplier arrangements since contracts were first signed.
Three things to do right now
1. Map every supplier that touches your personal data and check whether a signed DPA is in place for each one. A data map makes this much quicker.
2. Check your contracts include a breach notification obligation and a timeframe. You only have 72 hours to report a notifiable breach to the ICO, so your suppliers need to tell you well within that.
3. Carry out basic due diligence on your highest risk suppliers before their next review.
Supplier oversight is clearly a priority for the ICO. The organisations that will be best placed are the ones that treat third party risk as part of their own compliance position, not someone else's.
Do you know exactly which suppliers have access to your personal data, and do you have a signed DPA in place for every one? If not, our data protection audits include a review of key suppliers, and our policy and documentation support covers data processing agreements. Or start with a free data protection review.
