UK police unit’s unclear cyber responsibilities contributed to GDPR breaches, ICO says
By Imogen Howse ( August 12, 2026, 16:03 GMT | Insight) -- The failure by ACRO — the UK’s criminal records office — to clearly assign responsibility for critical cybersecurity updates and alerts contributed to UK GDPR infringements that put the personal information of almost 11,000 people at risk, the Information Commissioner's Office has said in a report. The ICO found that software updates went unapplied and that warnings of malicious activity went uninvestigated, which left ACRO's website vulnerable and allowed a hacker's activity to continue undetected. ACRO told MLex it accepted the ICO's findings and has worked hard to improve its systems and safeguards.The UK criminal records office’s failure to clearly assign responsibility for critical cybersecurity updates and alerts jeopardized the personal information of almost 11,000 people, according to a report by the country’s data privacy watchdog....
Prepare for tomorrow’s regulatory change, today
MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.
Know what others in the room don’t, with features including:
- Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
- Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
- Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
- Curated case files bringing together news, analysis and source documents in a single timeline
Experience MLex today with a 14-day free trial.