What Happened?
On May 20, 2025, Marks & Spencer (M&S) issued a communication to many of its UK customers alerting them to a recent cyberattack that compromised personal data. While M&S reassured the public that it was taking the matter seriously and that customers should stay alert, the incident has raised pressing questions about legal liability and data protection compliance.
How Customers Were Informed
Customers received direct emails explaining the situation. The correspondence encouraged vigilance but downplayed the severity—perhaps wisely, to avoid panic. Still, any exposure of personal data, regardless of intent or malice, triggers regulatory and legal scrutiny under UK data protection laws.
Legal Implications Under UK GDPR and DPA 2018
Role of the Information Commissioner’s Office (ICO)
The ICO serves as the UK’s regulatory body tasked with enforcing data protection regulations. When a data breach occurs, it assesses the organisation’s culpability and decides on appropriate enforcement measures.
Enforcement Options Available to the ICO
Monetary Penalties
Under the UK GDPR and Data Protection Act 2018, the ICO can impose fines of up to £17.5 million or 4% of an organisation’s global turnover, whichever is higher. However, such severe penalties are rare.
Enforcement Notices and Warnings
More commonly, the ICO opts for enforcement notices or formal reprimands. These compel companies to rectify vulnerabilities without imposing immediate financial penalties, unless gross negligence is evident.
M&S’s Potential Legal Liability
Class Action Risk Analysis
Given the breach’s scale, M&S could face group litigation from affected consumers. This follows precedents like the class action against British Airways, where 16,000 claimants joined in a collective lawsuit post-breach.
Defenses and Mitigating Factors
Several mitigating factors may help M&S reduce or avoid a fine:
- Rapid disclosure and public communication
- Cooperation with the ICO and National Cyber Security Centre (NCSC)
- Implementation of remedial measures
ICO’s Track Record: Case Studies
British Airways 2018 Breach
Originally fined £183.39 million, British Airways successfully appealed and reduced the penalty to £20 million. A confidential settlement was reached with thousands of claimants in 2021.
Marriott International 2019 Breach
The ICO proposed a fine of £99.2 million but reduced it to £18.4 million after considering Marriott’s response. Legal proceedings from affected individuals are still ongoing.
How the ICO Decides on Enforcement Action
Factors Considered in Penalty Assessment
- Nature and gravity of the breach
- Duration and extent of the data exposure
- Degree of cooperation with authorities
- Historical compliance record
Importance of Cooperation with Authorities
Transparency and proactive collaboration with the ICO and NCSC often yield leniency. This includes voluntarily disclosing the breach, providing updates, and executing mitigation strategies swiftly.
Advice for UK Companies Facing Data Breaches
Immediate Response Strategies
- Notify the ICO within 72 hours
- Communicate transparently with affected individuals
- Engage legal and cybersecurity experts
Long-Term Compliance Considerations
- Invest in data security infrastructure
- Regularly train staff on cyber hygiene
- Conduct periodic risk assessments
Class Action Lawsuits in the UK: Emerging Trends
Consumer Rights and Redress Options
Data breach victims can now more easily join group actions to seek compensation for non-material damage, such as emotional distress or loss of control over personal data.
Role of Law Firms in Group Litigation
Specialist law firms are actively coordinating class actions, offering “no win, no fee” models that make legal recourse accessible to the public.
What’s Next for M&S and Its Customers?
Possible Legal Outcomes
M&S may face no fine if it’s deemed not at fault. Alternatively, they may receive a reprimand or reduced penalty depending on ongoing cooperation and mitigation efforts.
Lessons for Other Businesses
This event underscores the importance of a robust data protection framework and a clear incident response plan. Regulatory scrutiny, litigation risk, and reputational damage are all real consequences of poor data governance.
FAQs on M&S Data Breach & ICO Enforcement
Is M&S definitely going to be fined by the ICO?
Not necessarily. The ICO often issues warnings or enforcement notices instead of fines if an organisation isn’t demonstrably at fault.
What should M&S customers do now?
Stay vigilant against phishing attempts and follow any instructions issued by M&S.
How long does the ICO take to complete an investigation?
Investigations can take several months, depending on the complexity of the breach and the organisation’s cooperation.
What legal defences does M&S have?
Key defences include prompt notification, active cooperation, and proactive risk mitigation steps.
How can other companies prepare for such incidents?
Implement strong cybersecurity policies, train employees, and ensure immediate incident reporting mechanisms are in place.
Is Your Business Protected Against a Data Breach?
The recent Marks & Spencer incident is a powerful reminder that even well-established companies are vulnerable to data privacy failures. Don’t wait for a breach to uncover compliance gaps in your organization.
Contact our Global Privacy Team to discuss further and arrange a data privacy health check and ensure your company complies with GDPR, CCPA, and other applicable data privacy laws.