Precedent corpus / ICO (United Kingdom)
Advanced Computer Software Group Limited
ICO (United Kingdom) case advanced-2025-03, decided . GBP 3.1M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
In August 2022 ransomware actors gained access to Advanced's systems through a customer-portal account that did not require multi-factor authentication, and exfiltrated personal information including sensitive health and care data of 79,404 UK individuals, causing widespread disruption to NHS services; Advanced failed to implement appropriate technical and organisational measures to ensure security of processing under Article 32(1) UK GDPR.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://ico.org.uk/media2/gdlfddgc/advanced-penalty-notice-20250327.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
The original notice of intent in August 2024 was GBP 6.09M; reduced to GBP 3.07M via voluntary settlement. First ICO penalty issued to a processor-only entity under UK GDPR. Cite when a scanner finds a vendor or sub-processor without MFA on an admin or service account - the precedent is that this is itself a 32(1) breach independent of any subsequent compromise.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-ico-advanced-2025-03,
author = {{ConsentMark}},
year = {2025},
title = {ICO (United Kingdom) advanced-2025-03 - Advanced Computer Software Group Limited},
howpublished = {\url{https://www.consentmark.com/precedent/ico-advanced-2025-03}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, March 27). ICO (United Kingdom) advanced-2025-03 - Advanced Computer Software Group Limited. Methodology v7.8.1. https://www.consentmark.com/precedent/ico-advanced-2025-03[ICO (United Kingdom) advanced-2025-03 - Advanced Computer Software Group Limited - ConsentMark](https://www.consentmark.com/precedent/ico-advanced-2025-03)ICO (United Kingdom) advanced-2025-03 - Advanced Computer Software Group Limited - ConsentMark, 2025-03-27, methodology v7.8.1, https://www.consentmark.com/precedent/ico-advanced-2025-03