# LastPass UK Ltd: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Information Commissioner (ICO)
- Date: 2025-11-20
- Original: https://www.enforcementtracker.com/ETid-2972
- Canonical: https://overview.legal/posts/49087
- Topics: Security, Controllers, Processing Agreement, Supervisory Authorities, Data Controller

## Summary

The UK DPA has imposed a fine of £ 1,228,283 (EUR 1,400,000) on LastPass UK Ltd. The controller suffered a succesfull cyber attack due to insufficient technical and organisational measures to ensure data security.

## Full text

The UK DPA has imposed a fine of £ 1,228,283 (EUR 1,400,000) on LastPass UK Ltd. The controller suffered a succesfull cyber attack due to insufficient technical and organisational measures to ensure data security.

GDPR Articles: Art. 5 (1) f) UK GDPR, Art. 32 (1) UK GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/49087 · 2026-08-22