ISSUING sanctions against Jacksons and the Medical Specialist Group formed part of a landmark year for the Data Protection Authority
One of the biggest successes highlighted in its 2025 annual report was the introduction of an innovative, outcome-focused framework designed to deliver faster, more effective regulatory results, which enabled it to take decisive action in matters of elevated risk.
‘Any data protection authority must be judged by the outcomes it achieves across a wide range of responsibilities,’ said outgoing chairman Richard Thomas.
He said the report showed ‘significantly heavier workloads and improved productivity’ over the year.
Data protection commissioner Brent Homan said balance, trust and partnership were the three regulatory pillars underpinning all the ODPA’s work, framing a ‘banner year of firsts and exceptional results’.
Two administrative fines were issued in 2025 – £65,000 against Jacksons and £100,000 against the Medical Specialist Group – as well as nine orders, a formal instruction to remediate issues.
There were also 259 self-reported breaches, 87 complaints, and 13 breach determinations, among other measures.
The report also sets out a new strategic plan for the coming years, which Mr Homan said showed the authority’s commitment to ‘elevating data protection in the Bailiwick by educating and equipping society, supporting a modern, safe and progressive digital economy, and responding to non-compliance proportionally, through assertive, agile enforcement’.