What ICO enforcement notices mean for Scottish marketing measurement

What to take away

What an ICO enforcement notice actually requires of a controller

An enforcement notice is a formal instruction. It names the controller, describes the infringement, states what must change and sets a deadline. Ignoring it is a separate breach.

The power comes from section 149 of the Data Protection Act 2018: the regulator may give a person a written notice (an "enforcement notice") which requires the person to take steps specified in the notice, or to refrain from taking steps specified in the notice, or both. Section 150 then fixes what the notice must contain. It must state what the person has failed or is failing to do and give the regulator's reasons, and it must provide information about the consequences of failure to comply and about the rights of appeal.

The ICO publishes these on its Enforcement action | ICO page, where Scottish marketing teams can see the exact wording used against organisations of similar size and sector. The page lists the action taken, the law breached and the practical steps required.

The statutory basis sits in the Data Protection Act 2018, which sets out the ICO's powers to issue notices, fines and assessments. That Act, alongside UK GDPR, is what gives an enforcement notice its teeth.

For an analytics team, the notice usually lands on three things: how consent was collected, how long data was kept, and whether attribution could be justified. A notice rarely asks for a new tool. It asks for evidence.

That means records of processing, consent logs, retention schedules and deletion proofs. If you cannot produce them, the notice will say so.

Scottish controllers answer to the same law as controllers in England, but the ICO runs a Scotland office in Edinburgh that engages devolved bodies such as NHS Scotland boards, Police Scotland and the 32 local authorities. The UK measurement rules start at the collection point, so consent design and data collection are one conversation.

The notice does not care where you are; the evidence does.

What the notice typically demands

Deadlines, appeals and the penalty for ignoring a notice

The notice may set the time or period within which each requirement must be met. Under section 150, that time cannot fall before the end of the period in which an appeal can be brought, and if an appeal is brought, the requirement need not be complied with until the appeal is decided or withdrawn. Section 162 gives a person who is given an enforcement notice the right to appeal to the Tribunal.

Ignoring a notice is costly. Under section 157 on maximum penalties, a failure to comply with an enforcement notice carries the "higher maximum amount": for an undertaking, £17,500,000 or 4% of its total annual worldwide turnover in the preceding financial year, whichever is higher.

Fines are not the only outcome. The ICO can issue a reprimand, an enforcement notice, or both. A reprimand is public and still damaging.

A Scottish example shows how public that is. On 9 March 2023 the ICO issued a formal reprimand to NHS Highland, which emailed 37 people likely to be accessing HIV services using CC instead of BCC, so every recipient could see the others' email addresses. The case had nothing to do with analytics, but the lesson carries over: a routine marketing send or tracking setup can become a published enforcement record.

Recent enforcement themes relevant to analytics and attribution

Recent ICO enforcement action shows a consistent pattern: consent mechanisms that do not meet the standard, retention that is undefined, and profiling that lacks a lawful basis. These themes recur across sectors.

Marketing is where most published enforcement notices land. The ICO's enforcement notice to Home Improvement Marketing Ltd, dated 28 August 2025, followed an investigation which found that between 31 May 2023 and 31 August 2023 the company instigated automated marketing calls to subscribers without their prior consent, contrary to regulation 19 of PECR, with no option to opt out of further calls. Similarly, the enforcement notice to Skean Homes Ltd, dated 16 January 2024, followed unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. Both cases turn on the same question an analytics team faces: can you show consent, and can people say no?

Consent remains the most common failure. Banners that make acceptance easier than rejection, or that set cookies before a choice is made, attract action. The standard is clear: consent must be freely given, specific, informed and unambiguous.

Retention is the second theme. Many organisations can state a retention period but cannot show deletion. Attribution data is often the worst offender because it is copied into dashboards, warehouses and spreadsheets.

Attribution itself is not unlawful. Keeping identifiers longer than necessary, or linking them to individuals without a basis, is where the risk sits. The ICO looks at purpose, necessity and proportionality.

Decision notices analytics teams should read are published separately on the Decision notices | ICO page. They show the reasoning behind a case, including how the ICO weighed evidence. That reasoning is useful when you design your own controls.

Scottish teams also need to watch public sector guidance. Publications - gov.scot can set expectations for how health boards, councils and other devolved bodies handle data, and those expectations often flow into contracts with marketing suppliers.

The three recurring failures

Consent, retention and attribution changes for Scottish teams

Start with consent. Audit every tag, pixel and script that fires on your site. Record what each one does, what it collects and whether it needs consent. Remove anything you cannot justify.

Next, write down your retention periods. For each data type, state how long you keep it and why. Then show how deletion happens. A retention policy without a deletion method is a promise you cannot keep.

Attribution needs a purpose test. Ask what decision the attribution supports, and whether that decision needs personal data at all. Aggregate reporting often answers the same question with less risk.

Turn your measurement data flow into a UK GDPR record a reviewer can follow. That means a diagram or table showing collection, storage, use, sharing and deletion, with owners named at each stage.

Public bodies in Scotland with larger spend publish procurement strategies under the Procurement Reform (Scotland) Act 2014, and those strategies sit alongside the Scottish Government's records management and data guidance. Health boards and councils therefore ask suppliers for consent logs and retention schedules they can file. Write your evidence in that form before you bid.

A worked example: a Scottish retailer

A Scottish retailer runs paid social and email. It uses a consent banner, a tag manager and a warehouse that joins ad clicks to purchases.

Step 1: It lists every tag and marks which need consent. Step 2: It sets a 13-month retention period for ad identifiers and a 25-month period for purchase records. Step 3: It builds a deletion job that runs monthly and logs results. Step 4: It replaces person-level attribution with aggregated reporting for channels that do not need identifiers.

Within one quarter, the retailer can show a consent log, a retention schedule and a deletion report. That is the evidence an enforcement notice would ask for.

Checklist for Scottish analytics teams

A buyer checklist that keeps PECR, security and accessibility in separate gates gives each gate its own evidence and its own owner before a supplier is signed.

Reading decision notices alongside enforcement notices

Decision notices are the ICO's written reasons in individual cases. They show what evidence was accepted, what was rejected and how the law was applied.

Read them as case law in practice. If a decision notice explains why a consent banner failed, your banner should be tested against that reasoning. If it explains why retention was inadequate, your schedule should answer the same points.

Enforcement notices tell you what was required. Decision notices tell you why. Together they give you a template for your own controls and for the questions an auditor will ask.

The Data Protection Act 2018 provides the framework for both. It sets out the ICO's powers and the rights of individuals, which is why the reasoning in decision notices often returns to fairness and transparency.

Scottish public authorities also answer freedom of information requests under the Freedom of Information (Scotland) Act 2002, which the Scottish Information Commissioner enforces from St Andrews. Analytics notes held by a council or health board can be released, so write them as if a requester will read them.

A simple habit: when a new decision notice appears, ask whether your current setup would survive the same scrutiny. If not, fix it before it becomes an enforcement matter.

Building a Scottish compliance response with review dates

A compliance response needs owners, actions and dates. Without dates, it is a wish list. The ICO checks whether changes were made, not whether they were intended.

Start with a one-page summary of your processing. Then attach a retention schedule, a consent inventory and an attribution purpose statement. Keep them together so a reviewer can follow the story.

Set review dates quarterly. Consent banners drift, tags get added, and retention jobs fail silently. A quarterly review catches drift before it becomes a breach.

Use the compliance guide to structure the first five decisions: lawful basis, consent design, retention, attribution and deletion. Each decision should have a named owner and a next review date.

Scottish Government publications cover health and social care data, records management and public sector procurement, and any of them can shift what a Scottish buyer expects from a measurement supplier. Give one person the job of checking gov.scot each quarter.

Finally, keep a log of what you changed and when. If an enforcement notice arrives, that log is the difference between a quick response and a long investigation.

Review calendar template

Common questions