A recent (February 26, 2026) Court of Appeal ruling has handed the Information Commissioner’s Office a significant victory in its long running enforcement action against DSG Retail Limited, owner of Currys, PC World and Dixons. The case stems from a 2017 to 2018 cyberattack and a £500,000 fine issued under the Data Protection Act 1998. At its core was a fundamental question: Must organisations protect personal data even if a hacker cannot directly identify individuals from the stolen information? The Court of Appeal has answered with a clear yes. [5]
What happened?
In 2020, the ICO fined DSG £500,000 following a cyberattack that exposed customer payment card data.
The investigation found failures to patch software, install appropriate firewalls, segment networks, and carry out routine security testing.
Hackers accessed 16-digit card numbers and expiry dates but did not obtain cardholder names.
DSG argued that because the attackers could not identify individuals from the stolen data, the information should not be treated as personal data in that context.
The Court of Appeal rejected this argument, confirming that personal data must be assessed from the perspective of the controller, not the attacker.
Why was this a problem?
DSG’s defence attempted to narrow the definition of personal data based on what a third party could do with it, rather than what the organisation itself could do.
The Court confirmed that if data is personal in the hands of the controller, it remains personal data and must be protected accordingly.
The original security failings involved basic technical and organisational measures that regulators expect as standard practice.
Accepting DSG’s argument would have weakened the obligation to safeguard data against malicious attacks.
The ruling reinforces the principle that organisations bear responsibility for protecting data they process, regardless of how criminals may exploit it.
What does it mean for your organisation?
This decision strengthens the protective duty placed on controllers. You cannot reduce your security obligations by arguing that stolen data is incomplete or not directly identifiable in the hands of hackers. If you can link the data to an individual, it is personal data and must be secured with appropriate measures.
The case also underscores that basic cyber hygiene remains firmly under regulatory scrutiny. Supervisory authorities continue to treat patch management, network segregation, and regular security testing as minimum compliance expectations. These baseline obligations remain fully applicable—particularly while the proposed new definition of personal data under the Omnibus reform has not been adopted and the current GDPR framework continues to apply in full.
To avoid similar pitfalls, organisations must:
Ensure timely software patching and vulnerability management across all systems.
Implement strong network segmentation and firewall protections.
Conduct regular security testing and document the results.
Assess personal data from the controller’s perspective when determining risk.
Embed accountability at the senior level for cyber and data protection governance.
The Takeaway?
Personal data does not lose its legal status simply because an unauthorised party lacks full contextual information. If the data relates to an identifiable individual under the GDPR, it remains personal data and must be protected accordingly by the controller.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on a risk that is less technical but equally serious: failing to put proper Data Processing Agreements in place with suppliers.
Many organisations invest time in drafting privacy notices and internal policies, yet overlook one of the most fundamental compliance requirements under Article 28 UK GDPR and EU GDPR. Where a third party processes personal data on your behalf, a written contract with specific mandatory clauses is not optional. It is a legal requirement.
No Contract, No Control
Across sectors, we continue to see organisations engaging payroll providers, cloud platforms, HR systems, marketing agencies and IT support companies without a compliant Data Processing Agreement in place. Sometimes there is a commercial contract, but it lacks the required data protection wording. In other cases, nothing has been signed at all.
These gaps often remain invisible until a breach occurs, a supplier relationship ends, or a regulator starts asking questions.
What’s the risk of missing Data Processing Agreements?
Regulatory exposure: Supervisory authorities routinely ask to see processor contracts during investigations. Failure to produce a compliant agreement is a clear breach in itself.
Loss of control over personal data: Without contractual safeguards, you have limited leverage over how a processor uses, secures, or deletes data.
Unclear security obligations: Article 28 requires processors to implement appropriate technical and organisational measures. Without this documented, expectations become blurred.
Sub-processor risks: If your processor appoints another provider without proper authorisation clauses, you may lose visibility of where data is going.
Reputational damage: Explaining to customers that a supplier mishandled their data without a proper contract in place is difficult and undermines trust.
Why it happens:
Omitting Data Processing Agreements is rarely deliberate. More often, it results from procurement shortcuts or misplaced assumptions.
Suppliers present standard terms and organisations assume they are compliant.
Contracts are signed before legal or data protection teams are consulted.
Smaller organisations believe the requirement only applies to large enterprises.
There is confusion about whether a party is acting as a processor or a controller.
Legacy supplier relationships pre-date GDPR and have never been updated.
How to fix it:
The solution is structured oversight and clear ownership of third party risk.
Map your processors: Maintain a live register of all suppliers handling personal data on your behalf.
Review contracts systematically: Check that Article 28 clauses are present and sufficiently detailed.
Clarify roles: Assess whether each party is a controller, joint controller, or processor before drafting terms.
Embed data protection into procurement: No supplier onboarding should proceed without DPA review.
Monitor and update: Revisit agreements periodically, particularly when services change or new sub-processors are introduced.
Data Processing Agreements are not administrative formalities. They define accountability, allocate risk, and provide the legal backbone for secure outsourcing. Without them, organisations surrender visibility and weaken their compliance position.
If your organisation needs support reviewing supplier contracts, drafting compliant DPAs, or mapping processor relationships, Ambit Compliance can help. Do not hesitate to contact us at info@ambitcompliance.ie and check further about us on our website https://www.ambitcompliance.ie/.
Contributors to this blog: Gillian Trainor and Facundo Heredia.
