Precedent corpus / ICO (United Kingdom)
LastPass UK Limited
ICO (United Kingdom) case lastpass-2025-11, decided . GBP 1.2M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
In August 2022 an attacker compromised the corporate laptop of an EU-based LastPass employee and then a US-based employee's personal laptop used for work, capturing a master credential and accessing the LastPass backup database to take customer names, email addresses, phone numbers and stored website URLs of up to 1.6 million UK customers; LastPass had not implemented appropriate controls around BYOD device usage, breaching Article 5(1)(f) and Article 32(1) UK GDPR.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://ico.org.uk/media2/xfbl1uaa/lastpass-uk-ltd-penalty-notice.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
The ICO highlighted BYOD-on-personal-devices as the central control failure - LastPass's zero-knowledge vault encryption prevented full credential extraction, but metadata loss alone was sufficient for an Article 32 breach. Cite when a scanner finds analytics or operations administered from personal devices outside a managed endpoint estate.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-ico-lastpass-2025-11,
author = {{ConsentMark}},
year = {2025},
title = {ICO (United Kingdom) lastpass-2025-11 - LastPass UK Limited},
howpublished = {\url{https://www.consentmark.com/precedent/ico-lastpass-2025-11}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2025, November 20). ICO (United Kingdom) lastpass-2025-11 - LastPass UK Limited. Methodology v7.8.1. https://www.consentmark.com/precedent/ico-lastpass-2025-11[ICO (United Kingdom) lastpass-2025-11 - LastPass UK Limited - ConsentMark](https://www.consentmark.com/precedent/ico-lastpass-2025-11)ICO (United Kingdom) lastpass-2025-11 - LastPass UK Limited - ConsentMark, 2025-11-20, methodology v7.8.1, https://www.consentmark.com/precedent/ico-lastpass-2025-11