On 17 December 2019, the ICO issued the first administrative fine under the GDPR (known as a monetary penalty notice in the UK), alongside an Enforcement Notice, against Doorstep Disparensee Limited (DDL).

DDL appealed against both elements of the enforcement action taken by the ICO which has recently been decided and provides useful guidance from the First-Tier Tribunal as to the nature of evidence required and expectations of both the regulator and of controllers.

The administrative fine was issued under the EU GDPR regime prior to the date that the UK left the EU (on 31 January 2020) but as the UK GDPR provisions concerning administrative fines are virtually identical to the EU GDPR provisions, this decision of the First-Tier Tribunal(1) is equally relevant to the calculation of administrative fines under the UK GDPR.