Data Protection Act 2018, section 155

(1)If the [^F646Commission^F646] is satisfied that a person—

(a)^F648has failed or is failing as described in section 149(2), (3), (4) [^F647, (5) or (5A)^F647] , ...

(b)has failed to comply with an information notice, an assessment notice[^F649 , an interview notice^F649] or an enforcement notice[^F650 , or

(c)has failed to comply with a duty imposed on the person by section 146A(6).^F650]

the [^F646 Commission ^F646] may, by written notice (a “penalty notice”), require the person to pay to the [^F646 Commission ^F646] an amount in sterling specified in the notice.

(2)Subject to subsection (4), when deciding whether to give a penalty notice to a person and determining the amount of the penalty, the [^F646Commission^F646] must have regard to the following, so far as relevant—

(a)to the extent that the notice concerns a matter to which the [^F651UK GDPR^F651] applies, the matters listed in Article 83(1) and (2) of the [^F651UK GDPR^F651] ;

(b)to the extent that the notice concerns another matter, the matters listed in subsection (3).

(3)Those matters are—

(a)the nature, gravity and duration of the failure;

(b)the intentional or negligent character of the failure;

(c)any action taken by the controller or processor to mitigate the damage or distress suffered by data subjects;

(d)the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented by the controller or processor in accordance with section 57, 66, 103 or 107;

(e)any relevant previous failures by the controller or processor;

(f)the degree of co-operation with the [^F652Commission^F652] , in order to remedy the failure and mitigate the possible adverse effects of the failure;

(g)the categories of personal data affected by the failure;

(h)the manner in which the infringement became known to the [^F653Commission^F653] , including whether, and if so to what extent, the controller or processor notified the [^F653Commission^F653] of the failure;

(i)the extent to which the controller or processor has complied with previous enforcement notices or penalty notices;

(j)adherence to approved codes of conduct or certification mechanisms;

(k)any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly);

(l)whether the penalty would be effective, proportionate and dissuasive.

(4)Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 149(5).

(5)Schedule 16 makes further provision about penalty notices, including provision requiring the [^F654Commission^F654] to give a notice of intent to impose a penalty and provision about payment, variation, cancellation and enforcement.

(6)The Secretary of State may by regulations—

(a)confer power on the [^F655Commission^F655] to give a penalty notice in respect of other failures to comply with the data protection legislation, and

(b)provide for the maximum penalty that may be imposed in relation to such failures to be either the standard maximum amount or the higher maximum amount.

(7)Regulations under this section—

(a)may make provision about the giving of penalty notices in respect of the failure,

(b)may amend this section and sections 156 to 158, and

(c)are subject to the affirmative resolution procedure.

(8) In this section, “higher maximum amount” and “standard maximum amount” have the same meaning as in section 157.