What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Police Service of Northern Ireland (PSNI) ultimately received a £750,000 fine from the Information Commissioner’s Office (ICO) after an FOI spreadsheet accidentally disclosed identifying details of 9,483 officers and staff. The figure is sometimes described as “nearly $1 million,” but £750,000 is the official penalty. It is separate from a much larger £119 million Northern Ireland Executive allocation for compensation and legal settlements.
What happened in the PSNI data breach?
On 8 August 2023, PSNI published a spreadsheet while responding to a Freedom of Information request. Information that should have been removed or redacted remained hidden in the file and could be accessed by recipients. The disclosure was an accidental FOI-process failure, not a ransomware attack or an external intrusion into PSNI’s network.
The published material identified 9,483 officers and staff—effectively the organisation’s workforce—through their surnames, initials, ranks and roles. The ICO and PSNI did not establish in the final account that every person’s address, telephone number or complete employment record was released, so those details should not be assumed.
PSNI reported the incident, activated a critical response and began internal and independent reviews. The ICO investigated the data-protection failures alongside those reviews.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
PSNI’s response to the ICO and the ICO’s final statement describe the sequence of events.
Why the disclosure was unusually serious
The risk came from both the scale of the disclosure and the identity of the people involved. The affected population consisted of serving police officers and staff in Northern Ireland, where being identified as a member of the security services can create personal-safety and intimidation risks.
During its investigation, the ICO said affected people reported changing routines, separating themselves from family members and moving home. Those are reported experiences, not a finding that every individual suffered each consequence.
PSNI said it offered crime-prevention advice, online tools, advice clinics and home visits. It also made up to £500 per affected person available for personal-security equipment or other safety-related purchases. In its May 2024 response, PSNI said about 90% of officers and staff had taken up that offer. These were immediate support measures, not compensation for the breach.
What the ICO found
The final enforcement action concerned the security obligations in UK data-protection law:
- UK GDPR Article 5(1)(f), requiring integrity and confidentiality;
- Article 32(1), requiring appropriate security for processing; and
- Article 32(2), requiring the organisation to consider risks when selecting security measures.
The monetary penalty was imposed under data-protection law. Although the incident occurred during an FOI response, the fine was not an FOI penalty.
The ICO concluded that straightforward controls could have prevented the disclosure, including checking spreadsheets for hidden rows, columns, tabs and other residual information before publication. The failure was therefore treated as a governance and process problem—not simply an individual employee’s mistake.
The ICO monetary penalty notice records the infringement period as 25 May 2018 to 14 June 2024.
Recommended Free Tools
Was PSNI fined £750,000 or £5.6 million?
£750,000 was the final fine. In May 2024, the ICO announced its intention to impose that amount. The final monetary penalty notice followed in September/October 2024, turning the proposal into an enforcement outcome. Northern Ireland Department of Justice accounts later recorded the penalty as £0.75 million.
The ICO said its initial calculation could have produced a £5.6 million penalty. That was not a second fine and was not the amount PSNI was ordered to pay. The regulator reduced the figure under its public-sector approach, explaining that transferring a larger sum from an essential public service to the regulator would not serve the public interest. The resulting penalty was intended to remain proportionate and dissuasive.
For a public body, a fine is ultimately paid from public funds. In practical terms, it is primarily an accountability sanction rather than money that directly compensates the people whose data was exposed.
Timeline of the enforcement and financial consequences
| Date | Event |
|---|---|
| 8 August 2023 | Spreadsheet published during an FOI response, exposing information about 9,483 officers and staff. |
| May 2024 | ICO announced its intention to impose a £750,000 penalty; PSNI described its support and remediation work. |
| September/October 2024 | ICO issued the final monetary penalty notice. |
| December 2025 | Northern Ireland Executive approved £119 million for compensation-related costs and an early settlement of legal proceedings. |
| August 2026 | The £750,000 penalty is final; the £119 million remains a compensation and settlement allocation rather than proof that all claims have been paid. |
The compensation bill is potentially far larger
The ICO fine and compensation claims have different legal purposes and should not be treated as one payment. In December 2025, the Executive approved £119 million to fund compensation relating to the breach and support an early settlement of proceedings. The Policing Board described the allocation as enabling PSNI to meet its legal obligations and compensate people adversely affected.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The allocation is not evidence that PSNI has already paid £119 million, that every claimant has been compensated, or that the final cost cannot change. It is also not money paid to victims by the ICO.
For public finances, this potential compensation exposure is more significant than the regulatory penalty:
| Payment or estimate | What it represents |
|---|---|
| £750,000 | Final ICO regulatory penalty against PSNI. |
| £5.6 million | ICO’s initial calculated penalty before its public-sector reduction; not a final fine. |
| Up to £500 each | PSNI safety-support offer for affected personnel, according to PSNI. |
| £119 million | Executive-approved funding allocation for compensation and legal settlements; not necessarily the final payout. |
What changed inside PSNI?
An independent review produced 37 recommendations covering organisational governance and accountability, responsibility, foundations, data sharing and usage, and data culture, skills and talent. By May 2024, PSNI said 14 recommendations had been implemented.
PSNI also said it:
- made the Deputy Chief Constable the Senior Information Risk Owner;
- created a Strategic Data Board and a Data Delivery Group;
- updated policies and developed a new service instruction; and
- expanded training.
These are reported remediation steps, not proof that every recommendation was complete by August 2026. The independent-review page and its published report set out the review’s framework.
Why spreadsheet controls matter to every public body
A spreadsheet can retain hidden rows, columns, worksheets, formulas, comments and metadata even when the visible screen appears clean. Safe publication requires more than deleting what a reviewer can see.
- Start from a clean export rather than the working file.
- Remove hidden rows, columns, worksheets, comments, formulas and metadata.
- Use a documented FOI and data-protection sign-off process.
- Have an independent reviewer inspect the file.
- Test what a recipient can reveal or recover from the released version.
- Apply heightened review to information about police, security or other high-risk personnel.
PSNI’s own published breach statistics show that this was part of a broader control challenge: it recorded 59 non-cyber personal-data breaches in 2022/23, 62 in 2023/24 and 48 in 2024/25. A separate PSNI FOI response counted 91 wrong-recipient personal-data breaches from August 2023 to December 2025. Those figures do not establish that each incident had the same cause or severity as the 2023 disclosure.
What the PSNI case means for taxpayers
The headline “nearly $1 million fine” understates and partly misstates the financial story. The official sanction is £750,000, while the compensation and settlement allocation is £119 million. The two amounts cannot simply be added as if they were the same type of cost: one is a regulatory penalty and the other is funding for claims and legal resolution.
The lasting accountability question is whether PSNI’s governance, training and publication controls prevent another high-risk disclosure. The fine is final; the ultimate compensation cost and the complete status of all 37 recommendations remain separate matters.
Frequently Asked Questions
Did PSNI actually pay a £750,000 fine?
Yes. The ICO’s May 2024 announcement was provisional, but a final monetary penalty notice followed in September/October 2024. The final penalty was £750,000.
Is the £119 million compensation allocation the same as the ICO fine?
No. The £750,000 is a regulatory penalty. The £119 million approved in December 2025 is funding for compensation and legal settlements, and it does not show that every claim has been paid.
Was the PSNI incident a cyberattack?
No. It was an accidental public disclosure through a spreadsheet released during an FOI response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
