Section 155(3)

Those matters are— the nature, gravity and duration of the failure; the intentional or negligent character of the failure; any action taken by the controller or processor to mitigate the damage or distress suffered by data subjects; the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented by the controller or processor in accordance with section 57, 66, 103 or 107; any relevant previous failures by the controller or processor; the degree of co-operation with the Commissioner, in order to remedy the failure and mitigate the possible adverse effects of the failure; the categories of personal data affected by the failure; the manner in which the infringement became known to the Commissioner, including whether, and if so to what extent, the controller or processor notified the Commissioner of the failure; the extent to which the controller or processor has complied with previous enforcement notices or penalty notices; adherence to approved codes of conduct or certification mechanisms; any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly); whether the penalty would be effective, proportionate and dissuasive.

← 2 · All articles · 4 →

Source: legislation.gov.uk · retrieved 2026-09-04