ICO takes action against Metropolitan Police Service

What happened

The UK Information Commissioner’s Office issued a reprimand and enforcement notice to the Metropolitan Police Service after officers used an unauthorised third‑party platform to share personal data. Between March 2023 and September 2024, about 500 accounts were created and data on 179 individuals, three under 18, was uploaded. The force suspended the platform in September 2024, added safeguards in January 2026, but the ICO required further governance improvements. The notice obliges the MPS to tighten approval, oversight, training and testing of third‑party services.

Why it matters

Other police forces must audit any external tools that process personal data, ensure formal risk assessments and contractual controls are in place, and maintain ongoing governance to avoid similar enforcement.

Business impact

Failure to implement robust third‑party governance could lead to regulatory action and reputational damage, prompting organisations to allocate resources to compliance reviews and staff training.

Checklist

• Assess and formally approve all third‑party services that process personal dataHigh priority

  Document risk assessments, obtain senior sign‑off and maintain an approved services register.

• Conduct a Data Protection Impact Assessment for any new technologyHigh priority

  Evaluate risks to individuals and record mitigation measures before deployment.

• Implement stronger governance and oversight proceduresHigh priority

  Establish clear roles, regular audits and periodic reporting on compliance with data protection obligations.

• Provide targeted staff training on data protection responsibilitiesHigh priority

  Ensure all users understand lawful processing, consent, and the importance of approved platforms.

Who reported it

Discussion