UK Court Rules on Data Protection Obligations After DSG Retail Cyber-Attack

In a significant ruling on February 19, 2026, the UK Court of Appeal upheld the Information Commissioner's Office's (ICO) appeal in the DSG Retail Ltd v Information Commissioner case. The court determined that data controllers must implement security measures to protect personal data, regardless of whether third parties can identify individuals from that data. The case stemmed from a cyber-attack on DSG Retail's payment systems between 2017 and 2018, where malware captured payment card data, affecting over 5.6 million cards. The stolen data included card numbers and expiry dates but lacked names or other identifying details. The ICO had fined DSG £500,000 for failing to safeguard this data, arguing that the data remained personal from the controller's perspective. The Upper Tribunal had previously sided with DSG, asserting that the lack of identifiability meant no personal data breach occurred, but this was overturned by the Court of Appeal. The case has been remitted to the First-tier Tribunal for reconsideration of the penalty.

Key Points: • The UK Court of Appeal ruled that data protection obligations apply regardless of third-party identifiability. • DSG Retail was fined £500,000 for failing to protect payment card data during a cyber-attack. • The ruling emphasizes the importance of a data controller's perspective in determining personal data status.