>If you have a U.K. Ltd company, you must pay them their annual fee. Businesses that only use data for routine purposes like staff administration, accounts and

>If you have a U.K. Ltd company, you must pay them their annual fee. Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt. The data protection fee only applies to businesses engaged in higher-risk data processing. The fee for a non-exempt business with turnover of <£632,000 is £40 per year. https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ https://ico.org.uk/for-organisations/data-protection-fee/dat... The primary purpose of ICO enforcement is to ensure compliance. The general principle is that the sanction administered should be of the lowest level necessary to ensure compliance. In your examples, the Electoral Commission suffered a breach due to a chain of vulnerabilities exploited by a sophisticated actor. In response to the ICO investigation, the Electoral Commission implemented a major overhaul of their security procedures including a formal process to manage and monitor patching and MFA. The ICO were satisfied that the EC had come into compliance and would remain compliant, so no fine was applied.