The 60-second summary
The ICO announced action against the Metropolitan Police Service on 14 October 2026 over unapproved sharing of personal information through a retail-crime platform. Its enforcement record identifies infringements of sections 35(1), 40 and 64(1) of the Data Protection Act 2018. Improvements to that platform did not resolve broader governance concerns. The operational lesson is to verify that approval controls work, rather than relying only on policy or contracts.
Timeline that matters
23 September 2026
14 October 2026
22 October 2026
What changed
The public announcement explains why a reprimand and enforcement notice were issued.It identifies missing safeguards, risk assessment and effective oversight of third-party services.
Who should care
Law-enforcement organisations processing criminal-offence informationPrivacy, procurement and technology-risk ownersSecurity and data discovery teamsService owners introducing external collaboration tools
Why this matters for global organisations.
Unapproved tools can bypass procurement while still receiving sensitive records. Connect system discovery, access controls and staff reporting with enforceable approval gates and repeatable assurance tests.
13 actions to start now
- Inventory external platforms using approved administrative and discovery methods.
- Identify informal tools through proportionate staff reporting and workflow interviews.
- Map information categories, purposes, recipients and retention.
- Assign one accountable owner to every technology and data flow.
- Record the relevant legal regime and lawful processing conditions with counsel.
- Create a clear intake path for urgent operational requests.
- Require a documented risk assessment and determine whether a DPIA is needed before use.
- Verify supplier terms, access arrangements and onward sharing.
- Configure proportionate technical controls to support the approved-services register.
- Train users on escalation and alternatives when a tool is not approved.
- Test whether the controls prevent or detect unauthorised uploads.
- Triage discovered use, preserve evidence and assess incident duties from the facts.
- Track remediation and repeat tests after operational or supplier changes.
Evidence worth retaining
- Service and data-flow inventory
- Approval register and exception decisions
- Legal-scope and DPIA assessments
- Supplier assurances and access reviews
- Training and escalation records
- Control-test results and detected-use investigations
- Remediation owners, target dates and completion proof
Questions to take to counsel or your conformity team
These are discussion prompts, not legal advice or conclusions.
- Does the processing fall under law-enforcement rules or another applicable regime?
- Who can approve exceptions and how are they detected?
- What data has already reached unapproved services?
- Can deletion and access restrictions be evidenced?
- How will assurance test actual practice rather than policy wording?
Official sources
PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.
PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.