Home / Issues / UK ICO £20 million GDPR penalty against British Airways for the 2018 data breach (reduced from a £183.39m notice of intent)
UK ICO £20 million GDPR penalty against British Airways for the 2018 data breach (reduced from a £183.39m notice of intent)
Decidedas of 31 Oct 2026United KingdomBritish Airways plcdraft
Current status
Confirmed fact · as of 16 Oct 2020
On 16 October 2020 the ICO imposed a £20 million GDPR penalty on British Airways plc for a failure to secure personal data (Article 5(1)(f) and Article 32 GDPR) arising from the 2018 cyber attack.
A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026
Confirmed fact · as of 16 Oct 2020
The £20 million penalty was a reduction from the £183,390,000 proposed in the 4 July 2019 notice of intent, reflecting BA's representations, mitigating factors and the economic impact of COVID-19.
A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026 · C Mayer Brown, British Airways Ultimately Fined £20m for Personal Data Breach by the UK ICO Under the GDPR (19 Oct 2020) · retrieved 31 Oct 2026
Confirmed fact · as of 31 Oct 2026
This was an administrative/regulatory data-protection enforcement action; it is not a criminal matter and involves no criminal conviction.
A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026
Unanswered question · as of 31 Oct 2026
No record of a First-tier Tribunal appeal by British Airways against the £20 million penalty has been located; absence of an identified appeal is not positive confirmation that none was brought.
A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026
Last reviewed 31 Oct 2026. An initial allegation is not the final event; this block is always shown.
How it unfolded
Issue raised · 16 Oct 2020
Proposition: The UK Information Commissioner's Office found that British Airways plc failed to process customers' personal data in a manner that ensured appropriate security, breaching Article 5(1)(f) and Article 32 GDPR, after a 2018 cyber attack in which an attacker accessed BA's systems and caused payment card and other personal data of customers to be diverted to an external domain; the Commissioner imposed a monetary penalty of £20 million.
Affected parties: British Airways plc, Information Commissioner's Office (UK), Affected British Airways customers
Originating record: A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026
Response · British Airways plc · 16 Oct 2020
Attributed claim · as of 16 Oct 2020
British Airways did not admit liability for the breach, and the Penalty Notice records that an extensive set of representations was made by BA during the process, including on the proposed penalty amount. Those representations, together with mitigating factors and the economic impact of the COVID-19 pandemic, were taken into account by the Commissioner in reducing the penalty from the amount proposed in the notice of intent to £20 million. — British Airways plc
A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026 · C Simmons & Simmons LLP, British Airways fined £20m over data breach (16 Oct 2020) · retrieved 31 Oct 2026
Outcome · Information Commissioner's Office (UK) · 16 Oct 2020
official findingbinding
Confirmed fact · as of 16 Oct 2020
On 16 October 2020 the ICO issued a Monetary Penalty Notice (case ref COM0783542) to British Airways plc, imposing a penalty of £20,000,000 for failing to keep customers' personal data secure in breach of Article 5(1)(f) and Article 32 GDPR. The Notice records that between 22 June and 5 September 2018 an attacker used a third-party supplier's compromised credentials to reach BA's internal network via a Citrix remote-access gateway and edited a JavaScript file on BA's website so that payment card data was sent to an external domain; it estimated that the personal data of about 429,612 customers and staff may have been affected, and found that BA did not detect the attack itself. The £20 million penalty was reduced from the £183,390,000 figure proposed in the Commissioner's notice of intent of 4 July 2019, after considering BA's representations, mitigating factors and the economic impact of the COVID-19 pandemic. This was the largest penalty the ICO had issued under the GDPR at the time, and it is an administrative/regulatory matter, not a criminal proceeding.
A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026 · C Simmons & Simmons LLP, British Airways fined £20m over data breach (16 Oct 2020) · retrieved 31 Oct 2026 · C Mayer Brown, British Airways Ultimately Fined £20m for Personal Data Breach by the UK ICO Under the GDPR (19 Oct 2020) · retrieved 31 Oct 2026
Remedy: Monetary penalty of £20,000,000 (reduced from the £183,390,000 proposed in the 4 July 2019 notice of intent).
Appeal/review: none — A right of appeal against an ICO monetary penalty notice lies to the First-tier Tribunal (General Regulatory Chamber). No appeal by British Airways against the £20 million penalty has been identified in the checked records; the penalty is recorded as the final outcome of the ICO proceeding. A Information Commissioner's Office (UK), Monetary Penalty Notice to British Airways plc (case ref COM0783542) (16 Oct 2020) · retrieved 31 Oct 2026
How to read this. Allegation, response and outcome are separate, dated records. "Decided/resolved" appears only where a cited outcome supports it. Materially affected parties can request a correction via Corrections & response.