Information Commissioner's Office Reviews 

I am not confident that ICO are going to resolve my SARs request to ANPR365, which I have also reported to BPA who have equally bad reviews.

I asked the Chester office if it was ok that you gov we're not sending me the data they have on me, when I asked for it. And twice ico sent me generic letters, not giving a answer. Well I suppose that's not what they do then. But that's up to them.

Omg this place is to be avoided they deleted my files run by police and you want info from police they deleted it corruption in massive scale why is this not shut fown poor people left mental unwell due to abuse from them please avoid

Needs closed down.

Immediately.

This is so corrupt it's disgusting.

**Title: Before trusting the ICO to protect your rights, find out who funds it.**

Before embarking on a complaint to the Information Commissioner's Office (ICO), I strongly recommend researching how this regulator is funded and understanding the limitations of its intervention.

Something I wish I had known 15 months ago.

According to the ICO's own website, **over 85% of its annual expenditure is covered by compulsory data protection fees paid by the organisations it regulates.**

Yes, the organisations whose conduct the ICO is responsible for scrutinising collectively provide the vast majority of its funding.

These are mandatory statutory fees, not voluntary contributions or payments for favourable treatment. Nevertheless, I believe this arrangement raises legitimate questions about regulatory independence, accountability and public confidence.

You can verify the funding arrangements yourself:

Can't paste link but add ICO address then the following
/about-the-ico/who-we-are/how-we-are-funded/

**My experience**

I have spent approximately 15 months pursuing complaints involving NHS organisations, outstanding subject access requests and disputed medical records.

Despite extensive correspondence and evidence submissions, significant issues remain unresolved to my satisfaction.

These are not trivial administrative matters.

Inaccurate medical information can potentially contribute to discrimination, diagnostic overshadowing, inappropriate treatment decisions, reputational damage and consequences extending across an individual's lifetime.

The law provides rights of access to personal information and rectification of inaccurate data. But what happens when an organisation does not adequately comply and the regulator declines further intervention?

In my experience, pursuing the ICO has not delivered the resolution I sought.

**My warning to others**

Before investing months or years in this process, understand that submitting a complaint to the ICO does not guarantee a detailed investigation, formal enforcement or correction of your records.

Research the regulator's powers, funding and accountability mechanisms. Understand that enforcing your data protection rights through the courts may be a separate option, with its own requirements and deadlines.

I am not claiming that the ICO's funding structure proves corruption or improper influence. I am questioning whether the regulatory system provides sufficiently effective protection for ordinary people.

After 15 months, I believe that is a question worth asking.

**The public deserves a regulator that is not only independent in law, but demonstrably accountable in practice. **

There is literally no point that the ICO still exists. Zero. They refuse to investigate and decline everything. Data breach, won't get involved, SAR not produced for 100 days or more, yeah dont bother contacting the ICO. Why does the organisation actually exist?
Sad reflection on the state of this country. You have zero rights as a private citizen, there are no rules or regulations that exist that they will help to enforce.
Save yourself the heartache. Get legal help if you can afford it and if not just accept that the ICO has no interest in helping individuals. Shut it down and save some tax payer cash.

Complete and utter waste of time and money. I submitted a subject access request to a company that has suspended my trading account due to "information they held about me". I submitted a SAR to find out what this information was and they never bothered to respond, despite repeated requests. I complained to the ICO and was told it was "not in the public interest" to progress my complaint. If they cannot deal with such a fundamental issue I struggle to see what the point of this organisation is and what I am actually paying for each year.

MoThe biggest was of public sector funding ever,
I asked them to send me information on consett in county Durhams pub watch data handling registration two years ago, I'm still waiting.
I contacted them regarding the police in Durham abuse of powers, searching data on their computers to satisfy their own curiosity, they want nothing to do with it.
I reported a public house sharing information to friends,without the permission from the individual, Nothing.
Disband them, stop waisting my hard earned taxes. Look into how many people/ organisations they have prosecuted. You'll be Not Amazed. Criminal prosecutions brought by the Information Commissioner's Office (ICO) typically occur in single-digit numbers each year, as the regulator primarily relies on civil enforcement tools like fines, reprimands, and enforcement notices rather than criminal trials. Weak as water.

The ICO is funded primarily by businesses, 85% of its expenditure. So if you are hoping they will investigate businesses who breach GDPR issues for the working man just forget it. They will not and that is that.

Utterly impotent. The ICO acknowledged that my complaints concerned two separate DSARs, but bundled them together because the issues were “similar” and refused to examine the later complaint properly despite the obvious breach. So the organisation's failure to extend in time, plus over-redactions and blurred scope went unpunished. It felt like box-ticking rather than review. Save yourself the time and put in a complaint to the organisation itself or some other platform that holds them accountable. ICO officers just want to get paid with minimum effort. Joke organisation.

My experience across ICO cases IC 304934 R6W0 and IC 392330 V2G7 followed a serious confidentiality breach within the NHS.
The breach itself was not hypothetical. The NHS body accepted that confidential information had been disclosed and that the incident had not been handled properly.
That should have been the point where the regulator really got to grips with what had happened.
Instead, what followed was years of me trying to get basic questions properly looked at.
Important emails I had sent while the situation was escalating were said not to exist or could not be found. The NHS body assured the ICO that searches had been carried out. I repeatedly questioned whether those assurances had actually been evidenced.
The ICO accepted the organisation’s account and closed the case.
Another statutory Ombudsman later looked at the same underlying handling and pushed further.
One email which the NHS body had said it could not locate after extensive searches was then found using eDiscovery. With another important email, the organisation said a comprehensive search showed it had never been received, but later provided the Ombudsman with a copy.
There were also no retained audit logs of the searches, and the Ombudsman found that the later investigation into what had happened was not sufficiently robust.
The Ombudsman upheld the complaint, finding maladministration and injustice.
That is the part I find hardest to accept.
This all started with a serious NHS confidentiality breach. I went to the ICO because it is the specialist regulator and because, as one individual, I had no realistic way of testing the assurances being given by a large public body.
I specifically questioned whether those assurances were reliable.
The ICO accepted them anyway.
The Ombudsman did not.
It pushed further and found that one supposedly missing email had actually been received, that the position on another important email did not add up, that there were no audit logs of the searches, and that the investigation itself was not good enough.
So another organisation, looking at the matter from a different remit, got further into the data handling and record keeping issues than the specialist regulator did.
That is a very poor reflection on the ICO.
The ICO may have powers on paper, but my experience was that those powers offered very little meaningful protection when I actually needed them.
For an individual trying to challenge a large public body after a serious confidentiality breach, the process felt completely one sided.
I am glad the Ombudsman eventually made some headway.
But it should not take years, multiple complaints and another public body stepping into what is clearly very close to ICO territory before basic problems with missing records, searches and evidence are properly identified.
For me, that is the fundamental problem.
The ICO is supposed to be there when the individual cannot get straight answers from a much larger organisation.
In my case, it accepted the organisation’s assurances.
Another body tested them properly and found problems.
That should concern anyone who thinks the ICO is there to protect the ordinary person.

The ICO simply does not care about an individual's data protection rights.
If there's a big, "sexy", well publicised breach then they're all over it. If you're an individual then they just can't be bothered. They're response is effectively "tough, live with it".
Waste of time organisation.

Hopelessly useless waste of government resources and tax payers funding. I submitted a dsar to a data controller and then raised a complaint when no response was forthcoming during the statutory period and persistent follow up emails. It took ICO nearly 11 months to issue a likely breach and corrective measure. Till date the data controller has not fully complied with my request. What are we doing in this country if the executive arm of Government is akin to an institution in an emerging economy. I was even accused of being rude for rejecting a referral to a Parliament department by ICO staff- which is the function of an MP to do.

Should be minus government criminals fact agreed with me then I asked for enforcement as the criminal did nothing still do nothing
These people are worse than criminals and proves crime does pay and we have a 2 tier law system ICO needs shutting down forever they can’t be trusted

Sent me a letter telling me if I don’t register by a certain date (about 2 weeks from the date of the letter) they will fine me £4K. They hadn’t even established what my business is before sending the letter. Disgusting behaviour from what I can make out is just a money making scheme.

Unfortuntely, I have had to give 1 star, if it offered stars in the minus these would be more appropriate. Clearly, the ICO is a government quango which has no teeth, especially when i was questioning government legislation. Their live chat advisor just pushed the legislation at me as if I was the expert, there was no assistance, help or clear advice. The live chat operator I was talking to, could not or would not answer the questions I raised with him, and as a result he cut me off the chat, and I was being especially polite during the conversation. I have informed the ICO previously of a serious breach to data but no action was taken. One way the government could save time and money is to shut down the ICO. I wouldnt even trust an organisation associated with the ICO as it means absolutely nothing with regards to your data protection. Lets see if they reply to this review or just cut me off again!

ICO is basically a Government Criminal Organisation set up as a sham to make the population think that they can have access to companies and organisations that hold their information, They are set up to protect these organisations Corruption and Criminality and keep it from being exposed, it is just an extension and a protection department to help these companies cover up their Criminal Activities, You do not think the Government would do anything or set up anything that would help individuals get accountability from criminal organisations the government protects.

I had a query about my recent name change on my registration so I called them. I spoke with Steven who answered my query straight away. He was friendly and helpful throughout the conversation, and I felt a lot better as I'd been a bit stressed before I called them.

My factual story starts in 2020 year when Southern Water LTD intentionally executed acts of forgery and fraud by falsifying my critical private data that I personally declared on my private accounts, under my private name, utilising my private credentials.
Southern Water LTD covertly and unlawfully executed a total falsification of my incurable disabled family’s 2-bedroom assessed use home and fabricated it as a 3-bed property by premeditated deliberate action.
They ignored official, verified by Digital and normal ID and factographical systemic evidence on zero-day move-in Data-Information-Declaration which resulted in Covert Unlawful Long Term Financial Siphoning and long-term illegal enrichment committed by Southern Water LTD on my accounts.
Southern Water LTD acted maliciously without my informed consent and COVERTLY updated my accounts FIVE months later while in contract by scraping data from unsolicited third parties COMPLETELY unrelated strangersand applying it to my household under my name without consent, IGNORING my official supported declaration without notification.
Interesting people, right? This explicit piece of criminal data manipulation and fraud was formally reported to OFWAT, WTRS, CCW, FRAUD.UK and I.C.O in November 2025 after I noticed and tracked small additional sums of money vanishing from my household means bank accounts monthly.
Every UK regulator OFWAT, WTRS, CCW, FRAUD.UK and I.C.O-rejected my complaint and responded: THERE IS NO PROBLEM HERE AND ALL TURNED THE BLIND EYE TO SYSTEMIC INSTITUTIONALISED STIGMA IMPACTING NEGATIVELY AND DESTROYING MY SMALL FAMILY PIECE BY PIECE.
Same ICO responded in September 2026-nearly 10 months later—as follows: Data falsification committed by Southern Water ltd under my personal private name and private data is outside of ICO merit and jurisdictions and ICO sees nothing wrong with that.
Well, ConFraudulations, because it seems forgery, fraud and falsification are allowed on your accounts in the UK.
Regardless of the ICO Edwards latest sexual harassment cases, office mobbing, wages fraud and structural embezzlement SCANDAL within the ICO fraudulent office environment where ICO Paul Arnold was rewarded a new senior chair outside of Crown Sole scope for the cover-up he premeditatedly orchestrated (Politico/The Times).
The ICO Edwards guy abandoned the agency; the complicit ICO Arnold guy hasn't got sacked but rewarded by Political decision in the Deceptive Board Restructuring cosplay dance, bringing him as a new board Non-Exec Director of ICO a brilliant elite rebranding of Parliament Illusion& political leadership rotation provides a convenient screen for the abuse & systemic defense ICO provided claiming third-party data scraping does not warrant intervention-means kangooroo justice .
It is funny when newly formed Information Commission can think they are in the rights when they formally rejected my case for injustice this month (September 2026), claiming it falls outside their merits, even though my case is dated November 2025, before their Restructuring cover-up move.
Nice.
When every regulatory body in the UK rejects and accept stigma, injustice and harm and when a UK regulatory body formally abdicates its statutory duties to protect citizen data from corporate manipulation, it demonstrates that systemic failure is total.
So when parliamentary and sole appointed UK regulators voluntarily and deliberately closed the door on enforcing data integrity and rejected justice against Southern Water's 2020-2025 illegal forgery and fabrication and covertly waited 10 months before they issued rejection in September 2026, especially when Permanent Officials successfully used legislative transition as a shield to exhaust ANY regulatory loop that resulted in intentional harm and premeditated systemic institutionalised stigma & abuse.
That is how you destroy innocent, hard-working families in corporate UK only because your face and accent sounds different.