# Birthlink: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Information Commissioner (ICO)
- Date: 2025-06-24
- Original: https://www.enforcementtracker.com/ETid-2766
- Canonical: https://overview.legal/posts/48881
- Topics: Security, Controllers, Processing Agreement, Supervisory Authorities, Law Enforcement, Data Controller

## Summary

The UK DPA has imposed a fine of £ 18,000 (EUR 20,725) on Birthlink. The controller, a scottish registered charity, failed to implement sufficient technical and organisational measures to ensure data security, resulting in the loss of irreplaceable personal records.

## Full text

The UK DPA has imposed a fine of £ 18,000 (EUR 20,725) on Birthlink. The controller, a scottish registered charity, failed to implement sufficient technical and organisational measures to ensure data security, resulting in the loss of irreplaceable personal records.

GDPR Articles: Art. 5 (1) f), (2) GDPR, Art. 32 (1), (2) GDPR, Art. 33 GDPR
Industry: Individuals and Private Associations

---
Generated by overview.legal · https://overview.legal/posts/48881 · 2026-08-22