ICO (UK) - KRA Consultancy Ltd
Facts — The Information Commissioner, the DPA, investigated KRA Consultancy Ltd, the controller, in relation to unsolicited direct marketing SMS messages promoting debt-related services. The case was initially connected to investigations into other companies and individuals involved in mass SMS marketing. During these investigations, the DPA identified links between the controller, debt advice websites, bulk SMS platforms, short URLs and complaints submitted by subscribers to the 7726 spam reporting service. The controller was found to have used different trading names, websites and bulk messaging services to send large volumes of SMS messages to subscribers. These messages promoted debt write-off or debt solution services and invited recipients to click links leading to websites operated by, or connected to, the controller. The DPA also found evidence that the controller used personal data obtained from loan decline datasets and other third-party sources. The controller did not demonstrate that the subscribers had provided valid consent to receive marketing SMS messages about debt solutions. The DPA further found that the controller used so-called “fake bailiff messages” to pressure individuals into responding. These messages suggested that enforcement agents or bailiffs would attend the recipient’s address. The DPA considered that these messages targeted financially vulnerable individuals and were likely to cause distress. During the investigation, the DPA executed search warrants and seized electronic devices. The evidence included WhatsApp messages, SMS messages, access to bulk SMS platforms, customer communications, call recordings and internal group chats. These showed that the controller was involved in the transmission or instigation of the SMS messages and had sought to make the messages difficult to trace. Holding — The DPA held that the controller infringed Regulation 22 PECR by transmitting or instigating the transmission of unsolicited direct marketing SMS messages without valid consent. The DPA found that, between 24 April 2022 and 29 May 2025, 5,575,715 direct marketing SMS messages were delivered by, or at the instigation of, the controller. These messages generated over 60,000 complaints to the 7726 spam reporting service. The DPA considered that the controller could not rely on valid consent. Consent under PECR must meet the UK GDPR standard, meaning that it must be freely given, specific, informed and unambiguous. The DPA found no evidence that the subscribers had specifically consented to receive marketing from the controller. The use of old or purchased datasets, and the absence of adequate due diligence, did not meet the required standard. The DPA also held that the controller infringed Regulation 23 PECR. The controller had concealed its identity by using generic trading names, anonymous websites and messaging services designed to make the SMS activity untraceable. The DPA considered this conduct especially serious because recipients were not properly informed of who was behind the marketing communications. The DPA found that the infringement was serious due to the very high volume of messages, the number of complaints and the nature of the marketing. It also found that the infringement was deliberate. The controller had obtained loan decline data, failed to verify consent, used fake bailiff messages and sought repeated assurances that the messages could not be traced. In the alternative, the DPA found that the controller was at least negligent. The controller knew or ought to have known about the risk of non-compliance, given the DPA’s public guidance on direct marketing and consent. The controller nevertheless failed to take reasonable steps to prevent the contraventions. As aggravating factors, the DPA considered that the controller concealed its identity, targeted financially vulnerable individuals, sent distressing fake bailiff messages, provided debt-related advice despite not being FCA-authorised, misled the DPA during the search warrant, obstructed the investigation and continued unlawful marketing activity after the warrant. The DPA found no mitigating factors. The DPA therefore issued a monetary penalty of £300,000. The penalty could be reduced to £240,000 if paid early and if no appeal was lodged.
How it connects
Related across sources
Full text 106 findings
20 May 2026 FOR PUBLIC RELEASE Contents Introduction.............................................................................................................................3 Legal framework....................................................................................................................4 Background to the case.....................................................................................................8 The contravention...............................................................................................................19 Seriousness of the contravention .............................................................................21 Deliberate or negligent....................................................................................................22 The Commissioner’s decision to issue a monetary penalty.......................24 The amount of the penalty ............................................................................................27 Conclusion and right of appeal...................................................................................27 Annex..........................................................................................................................................30 2FOR PUBLIC RELEASE DATA PROTECTION ACT 1998 SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER MONETARY PENALTY NOTICE To: KRA Consultancy Ltd Of:
Hardman Street, Spinningfields, Manchester, M3 3HF Introduction 1 The Information Commissioner (“the Commissioner”) has decided to issue KRA Consultancy Ltd (“KRA”) with a monetary penalty under section 55A of the Data Protection Act 1998 (“DPA”) in the sum of £300,000. This Monetary Penalty Notice (“Notice”) is in relation to a serious contravention of regulations 22 and 23 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).
In accordance with section 55B of the DPA, KRA was previously served with a Notice of Intent dated 27 February 2026 which set out the Commissioner’s provisional findings. Having considered KRA’s representations submitted on 9 April 2026, the Commissioner is satisfied that a monetary penalty remains an appropriate sanction.
This Notice explains the Commissioner’s decision. 3FOR PUBLIC RELEASE Legal framework
KRA, whose registered office address is given above (Companies House Registration Number: 13667688) is the organisation stated in this Notice to have transmitted or instigated the transmission of unsolicited communications by means of electronic mail to individual subscribers for the purposes of direct marketing contrary to regulations 22 and 23 of PECR.
Regulation 22 of PECR states: “(1) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers. (2) Except in the circumstances referred to in paragraph (3), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender. (3) A person may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient; (b) the direct marketing is in respect of that person’s similar products and services only; and 4FOR PUBLIC RELEASE (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication. (4) A subscriber shall not permit his line to be used in contravention of paragraph (2).”
R egulation 23 of PECR states that “A person shall neither transmit, nor instigate the transmission of, a communication for the purposes of direct marketing by means of electronic mail – (a) where the identity of the person on whose behalf the communication has been sent has been disguised or concealed; (b) where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided; (c) where that electronic mail would contravene regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002; or (d) where that electronic mail encourages recipients to visit websites which contravene that regulation.” 5FOR PUBLIC RELEASE
Regulation 2(1) of PECR defines direct marketing as “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”. 1
The Commissioner has issued public guidance for organisations in relation to Direct Marketing. 2 This provides clear guidance on the circumstances under which direct marketing emails can be sent.
From 1 January 2021, consent in PECR has been defined by reference to the concept of consent in the UK GDPR as defined in section 3(10) of the Data Protection Act 2018 (“DPA18”) 3: see regulation 2(1) of PECR, as amended by Part 3 of Schedule 3, paragraph 44 of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019/419. Article 4(11) of the UK GDPR sets out the following definition: “‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.
Recital 32 of the UK GDPR materially states that “When the processing has multiple purposes, consent should be given for all of them”. Recital 42 materially provides that “For consent to be informed, the data subject should be aware at least of the identity of the controller”. Recital 43 materially states that “Consent is presumed not to be freely given if it does not allow separate consent to be given to different 1 Prior to 20 August 2025, the definition of “direct marketing” had been provided for by Section 122(5) of the DPA18. Section 110(2)(c) Data (Use and Access) Act 2025 has since amended Regulation 2 of PECR to incorporate this definition. 2Direct marketing guidance | ICO; and Electronic mail marketing | ICO. 3The UK GDPR is therein defined as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018. 6FOR PUBLIC RELEASE personal data processing operations despite it being appropriate in the individual case”. 11. “Individual” is defined in regulation 2(1) of PECR as “a living individual and includes an unincorporated body of such individuals”.
A “subscriber” is defined in regulation 2(1) of PECR as “a person who is a party to a contract with a provider of public electronic communications services for the supply of such services”. 13. “Electronic mail” is defined in regulation 2(1) of PECR as “any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service”.
Section 55A of the DPA (as applied to PECR cases by Schedule 1 to PECR, as variously amended) states: “(1) The Commissioner may serve a person with a monetary penalty if the Commissioner is satisfied that – (a) there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person, and (b) subsection (2) or (3) applies. (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the person – (a) knew or ought to have known that there was a risk that the contravention would occur, but (b) failed to take reasonable steps to prevent the contravention.” 7FOR PUBLIC RELEASE
The Commissioner has issued statutory guidance under section 55C (1) of the DPA about the issuing of monetary penalties. The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe that the amount of any penalty determined by the Commissioner must not exceed £500,000. 5
PECR were enacted to protect the individual’s fundamental right to privacy in the electronic communications sector. PECR were subsequently amended and strengthened. The Commissioner will interpret PECR in a way which is consistent with the Regulations’ overall aim of ensuring high levels of protection for individuals’ privacy rights.
The provisions of the DPA remain in force for the purposes of PECR breaches occurring before 5 February 2026 notwithstanding the introduction of the DPA18 and the Data (Use and Access) Act 2025. 6 Background to the case 18. This Notice does not purport to identify exhaustively each and every circumstance and document relevant to the Commissioner’s investigation. The circumstances and documents identified below are a proportionate summary. 4 Information Commissioner’s guidance about the issue of monetary penalties prepared and 5ssued under section 55C(1) of the DPA98. The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010. 6see paragraph 58(1) of Schedule 20 to the DPA18 and regulation 11 of The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026. 8FOR PUBLIC RELEASE
Mobile phone users can report the receipt of unsolicited marketing text messages by forwarding the message to the spam reporting service via ‘7726’ (spelling out “SPAM”). The Commissioner is provided with access to the data on complaints made to the 7726 service and uses this data to identify breaches of PECR.
KRA was incorporated on 7 October 2021 and is registered with Companies House under company number 13667688. The registered office address is 1 Hardman Street, Spinningfields, Manchester, M3 3HF.
Khuram Rezvan Ahmad ("Ahmad") was registered as the sole director and shareholder of KRA from 7 October 2021 to 6 October 2022. On 6 October 2022, he transferred his directorship and shares to his wife, Bushra Yaqub (“Yaqub”).
KRA has been registered with the ICO as a data controller since 7 March 2022 under registration number ZB310709. The nature of work is listed as 'Independent Financial Adviser' and the contact is Ahmad whose job title is listed as 'Director'. KRA is not registered with or authorised by the FCA.
KRA first came to the attention of the Commissioner during an investigation into another individual, namely Daniel George Bentley ("Bentley").
In June 2023, the Commissioner applied for and executed search warrants on Bentley’s premises, which identified a number of companies for whom he sent text messages. These companies included Clarke & Jones and Scott & Chambers. 9FOR PUBLIC RELEASE
Ahmad was identified as being the point of contact for Clarke & Jones and Scott & Chambers.
The Commissioner's investigations established that on 7 March 2022, Ahmad informed that he had purchased an “ICO license” for KRA and was “shutting Scott and Chambers.” On 16 March 2022, Ahmad asked another individual to purchase the domain name kraconsultancy.co.uk and to change their email addresses from Scott & Chambers to KRA Consultancy.
On 5 D ecember 2023, the Commissioner issued an Enforcement Notice to Bentley after concluding that he and his company sent over 2.5 million unsolicited direct marketing text messages in breach of regulations 22 and 23 of PECR.
Between April 2022 and July 2024, the Commissioner conducted investigations into two further entities, Debt Resolve and Control My Debts, which were the subject of over 30,000 complaints to the 7726 spam reporting service.
In July 2024, the Commissioner executed a search warrant at two addresses in relation to a company named Limited. At one address, the search team encountered and seized an active SIM farm and over 200 SIM cards. A number of personal electronic devices, including a mobile phone and several laptops, were also seized.
Forensic analysis of the data extracted from the electronic devices seized during the execution of the warrant identified several Skype conversations between the director of and an account manager at Telecom which included examples of the messages they were sending on behalf of an unnamed client. Many of 10FOR PUBLIC RELEASE the messages included the name ‘Khuram’ and/or the postcode ‘ ’.
Following the search warrant and seizure of equipment, similar text messages continued to be sent, resulting in over 29,000 complaints to the 7726 spam reporting service. The following are examples of the messages sent: “[Name] you are eligible to use a FREE legal write-off process to clear your debts. Visit bit.ly/3W9V1it for a pack in the post” “[Name], You may be eligible for a FREE debt write-off scheme. Click www.debt-writeoff.co.uk for a FREE pack to [postcode]. Optout bit.ly/47mdGeK”
The Commissioner established that the short URL bit.ly/3W9V1it redirected to the website kraconsultancy.co.uk which was operated by KRA.
The Commissioner also established that the opt out link bit.ly/47mdGeK redirected to an unsubscribe page on the website .com. An information request made by the Commissioner to .com on 30 September 2024 revealed that the .com account was created on 10 November 2023 by @kraconsultancy.co.uk using the IP address
On 28 May 2025, the Commissioner applied for search warrants in order to enter and search offices occupied by KRA and Clarke & Jones Ltd and the home address of Ahmad and Yaqub. 11FOR PUBLIC RELEASE
The search warrants were executed by the Commissioner on 29 May 2025. During the course of the search warrant, Ahmad admitted to paying Bentley to send text messages on his behalf and to acting as an introducer to a company called However, Ahma d claimed to have only sent messages to people who had opted in.
Ahmad re fused to hand over his personal mobile phone. The Commissioner seized a number of items from the premises, including four computer towers, five mobile phones and several notepads containing handwritten notes relating to individuals and their debts. Also seized was an introducer call monitoring form which listed the introducer name as ‘KRACON CONSULTANCY (DEBT RESOLVE)’.
Forensic analysis of the evidence found a number of relevant items, including: • WhatsApp and SMS messages between Ahmad and Bentley; • WhatsApp and SMS messages between Ahmad and • WhatsApp messages between Ahmad and a web developer named ; • WhatsApp messages between Ahmad and Yaqub; • WhatsApp messages between Ahmad and Telecom; • Internet history showing access to Telecom's bulk SMS platform; • WhatsApp messages sent to WhatsApp groups named ‘Clarke & Jones’ and ‘KRA Consultancy’; • Audio files containing recordings of calls to prospective customers; • WhatsApp and SMS messages between KRA Consultancy and prospective customers; and 12FOR PUBLIC RELEASE • An introducer due diligence questionnaire completed by Ahmad on 12 April 2023.
The messages between Ahmad and Bentley show that during 2020 and 2021, Bentley was sending direct marketing texts for Clarke & Jones and Scott & Chambers using the websites DebtKO, EaseMyDebt.co.uk and CalculateMyDebt.co.uk, and loan application data provided by an associate of Bentley referred to as “matey”. Ahmad was reimbursing Bentley for the data, SIM cards and top-up vouchers, as well as paying Bentley’s “wages".
Bentley was also sending what Ahmad described as “fake bailiff messages” on his behalf in order to increase response rates. The Commissioner believes that these messages targeted financially vulnerable individuals for the purpose of falsely leading them to believe that bailiffs would be visiting their home address.
Following a complaint from a data broker alleging that the data they were using was three years old, Ahmad told Bentley: "Am I confident on the data set? As long as I'm doing the cases I don't really give a fuck if it's old as long as it's making money".
On 4 April 2022, Ah mad contacted Telecom via WhatsApp. He explained: "I need to be able to send mass text messages out that are untraceable and are cost effective and get the deliverability of the message is high. Could you help with this”. Ahmad confirmed that the content of the text messages he wanted to send was as follows:u “LEG AL NOTICE FOR (NAME) Enforcement & Collections agents will be attending (custom 1 (custom 2) within 7 days in relation to your 13FOR PUBLIC RELEASE outstanding balance. Despite numerous attempts to contact you for resolution, we have been unable to reach you. This matter has now been passed on to collections. Please make payment immediately or your possessions may be listed for removal and you may incur additional costs. If you are in any asset, legal or debt protection scheme, you will need any relevant documentation readily available.”
On 7 April 2022, Ah mad asked to set up a new website landing page using the website .co.uk as a template. He suggested various names for the new website, including ‘Resolve My Debt’ and ‘Write Off My Debt’, before settling on ‘Control My Debts’.
On 11 April 2022, Ahma d sent a WhatsApp voice note to Yaqub, updating her on his discussions with Telecom. The following is an extract from the voice note: “I’ve got access to the system. I know how to use it. It’s untraceable. It’s in China. It’s a bit cheaper than But the main thing is it’s untraceable. So what’s going to basically happen is I’ve just tested it. It works. I’ve sent a few messages out. Now I’m going to use that for obviously the bailiff stuff but I’m going to use that for leads as well when the website goes live.”
On 13 April 2022, Ahmad provided Telecom with an example of the main text message he would be sending: “Khuram Ahmad you may be eligible to write off 75% of your debts. Clic on www.controlmydebts.co.uk for FREE pack to He explained that he “could be sending 70k per week” of these messages. 14FOR PUBLIC RELEASE
Ahmad sought repeated assurances from Telecom that the messages could not be traced: "These messages cannot be traced right?" "Do I need to hide my IP address when I send because I don't want anything being traced back to me" "This is the message I can't have tracked back to me so needs to be completely untraceable"
On 9 May 2022, Ahmad t old Telecom that he was using an “old data file” and asked whether they knew any data suppliers in the UK. He explained that he just needed “raw data so name number and post code” but “relatively fresh data from maybe loan declines or something”. On the same day, Ahmad sent the following WhatsApp message to a contact saved in his phone under the name ‘ Data’: “Hi I’ve been forwarded your number from He did mention you was away so was wondering when would be convenient to jump on a call? Sorry it was regarding buying data”
On 13 May 2022, ‘ Data’ confirmed he could supply 50,000 records for £2,000. He provided his company name as
Companies House records show that is the director of Ltd, a ‘management consultancy’ based in Bolton.
Messages between Ahma d and show that Ahmad co ntinued to purchase personal data from until at least August 2022. 15FOR PUBLIC RELEASE
One of the mobile phones seized by the Commissioner during the execution of the search warrants on 29 May 2025 was found to contain over 27,000 WhatsApp messages sent to a WhatsApp group named 'KRA Consultancy' between 21 November 2022 and 28 May 2025. The members of the group included Ahmad and various employees of KRA. The WhatsApp messages included examples of text messages sent to individuals containing the short URLs investigated by the Commissioner (referred to in paragraph 31 above).
The WhatsApp messages also included numerous references to “coaching” messages which Ahmad appears to have used as a euphemism for fake bailiff messages. For example: “6% is a low number boys and is easily attainable number. Remember the risks we take aswell coaching which doubt anyone else does so 6% should be a walk in the park” “Get through as much as and pitch whatever Dont worry about forcing anything back because the coaching will take care of that tomorrow morning” “Utilise the coaching message by asking if anyone is chasing you otherwise pointless sending it out” “Coaching will be done at 9:15 so hit leads straight away before working on previous cases” “Evening boys. 8 cases pending that are over that we should aim to get done this week. We should be aiming for 9 this week as you should have 2-3 between you. Coaching will be done and tomorrow we need 2 16FOR PUBLIC RELEASE cases over and deals aswell boys. You need to find time to ring your leads if I’m doing the 48 hour so manage time between Missing MI, cases that are back and dialling out”
In a WhatsApp message to the group dated 28 November 2022, Ahma d posted a screenshot of the “coaching” messages he had sent to prospective customers from the sender ID ‘DEMAND’. The first message stated: “You have failed to contact us. This matter has escalated and an Enforcement agent will attend within 7 days to remove your goods as per Court Order.” The second message stated: “We have attempted on numerous occasions to contact you without any success. This matter has escalated further and an Enforcement agent will attend within 48 hours to remove your goods as per Court Order. If you are on any legal/debt plan you will need proof readily available”.
SMS and WhatsApp exchanges between KRA and prospective customers were found on the mobile phones seized from the office address. It appears from these messages that KRA Consultancy were using the fake bailiff messages to pressurise people who had made online enquiries into returning their paperwork.
Searches of the office computers identified a large number of emails, invoices and other documents which confirmed that KRA were generating packaged IVA cases for
WhatsApp messages between KRA and prospective customers show that KRA were using FCA registration by providing links to website and Trustpilot reviews and claiming “This is our company website and reviews to have a look at.” Only when a prospective customer raised concerns about 17FOR PUBLIC RELEASE the legitimacy of the company, did they provide their own company details and explain the true nature of their relationship with
On 21 July 2025, the Commissioner issued a T hird Party Information Notice to bulk SMS provider requesting information regarding the user account ‘krasms’, which had been identified by the Commissioner as an account used by KRA. 57. confirmed that the subscriber to the 'krasms' account was KRA and the contact was Khuram Ahmad ( @kraconsultancy.co.uk). A total of 593,547 SMS messages were sent from the account, 452,084 of which were delivered. Message logs provided by showed that the messages were sent over a three month period, between 2 and 20 November 2023, and between 29 July 2024 and 7 October 2024.
On 31 October 2025, further searches of the 7726 database identified 161 complaints about text messages promoting the website debtcareuk.com between 29 September 2025 and 29 October 2025.
The Commissioner investigated Debt Care UK further as the website layout and wording was similar to KRA.
The Commissioner submitted an enquiry on the website, before receiving a call back from the telephone number 0161
Searches of the data extracted from the electronic devices seized during the execution of the search warrants revealed that the number 0161 appeared in Scott & Chambers’ Data Protection & Security Policy as the contact number for Ahmad. 18FOR PUBLIC RELEASE
The Commissioner has made the above findings of fact on the balance of probabilities.
The Commissioner has considered whether those facts constitute a contravention of regulations 22 and 23 of PECR by KRA and, if so, whether the conditions of section 55A DPA are satisfied. The contravention
Having considered the representations made by KRA, the Commissioner is satisfied that KRA has contravened regulations 22 and 23 of PECR.
The Commissioner finds that the contravention was as follows:
The Commissioner finds that between 2 to 20 November 2023 and 29 July 2024 to 7 October 2024, there were 452,084 direct marketing SMS messages received by subscribers. The Commissioner finds that KRA transmitted or instigated the transmission of those direct marketing messages, contrary to regulation 22 of PECR.
The Commissioner also finds that during the entire contravention period from 24 April 2022 to 29 May 2025, there were 5,575,715 direct marketing SMS messages delivered. The Commissioner finds that KRA transmitted or instigated the transmission of those direct marketing messages, contrary to regulation 22 of PECR, resulting in over 60,000 complaints to the 7726 spam reporting service.
KRA, as the sender or instigator of the direct marketing, is required to ensure that it is acting in compliance with the requirements of 19FOR PUBLIC RELEASE regulation 22 of PECR, and to ensure that valid consent to send those messages had been obtained.
The Commissioner has issued guidance on what constitutes ‘valid consent’.7
For consent to be valid it is required to be “freely given”, therefore, people must have genuine choice and control over whether or not to consent to the direct marketing. It follows that if consent to marketing is a condition of subscribing to a service, the organisation will have to demonstrate how the consent can be said to have been given freely.
Consent is also required to be “specific” as to the type of marketing communication to be received, and the organisation that will be sending it.
Consent will not be “informed” if individuals do not understand what they are consenting to. Organisations should therefore always ensure that the language used is prominent, clear, easy to understand, and not hidden away in a privacy policy or small print. Consent will not be valid if individuals are asked to agree to receive marketing from “similar organisations”, “partners”, “selected third parties” or other similar generic descriptions.
Consent must also be “unambiguous”, therefore it must be obvious that someone has consented to the direct marketing activity, and there must be a clear affirmative action to indicate that they have provided their consent. 7 What is valid consent? | ICO 20FOR PUBLIC RELEASE
The Commissioner is satisfied from the evidence he has seen that KRA did not have the necessary valid consent for the 5,575,715 direct marketing messages received by subscribers.
The Commissioner is further satisfied that the actions of KRA including the taking of steps to conceal their identity have contravened regulation 23 of PECR.
The Commissioner has gone on to consider whether the conditions under section 55A DPA are met. Seriousness of the contravention
The Commissioner is satisfied that the contravention identified above was serious. This is because between 24 April 2022 and 29 May 2025, a total of 5,575,715 direct marketing messages were sent by or sent at the instigation of KRA, resulting in over 60,000 complaints to the 7726 spam reporting service. These messages contained direct marketing material for which subscribers had not provided valid consent.
The contravention is serious due to the volume of messages sent and the number of complaints received. Furthermore, the contravention is deemed deliberate.
The Commissioner is therefore satisfied that condition (a) from section 55A(1) DPA is met. 21FOR PUBLIC RELEASE Deliberate or negligent
The Commissioner has considered whether the contravention identified above was deliberate. In the Commissioner’s view, this means that KRA’s actions which constituted that contravention were deliberate actions (even if KRA did not actually intend to contravene PECR).
The Commissioner considers that in this case KRA did deliberately contravene regulations 22 and 23 of PECR.
This finding is made on the following bases: • KRA obtained loan decline data from various sources and made no attempt to ensure this data was up to date or that the data subjects had consented to receiving marketing messages about debt solutions. • Furthermore, ‘fake bailiff messages’ were sent to the data subjects, along with an individual working for KRA seeking repeated assurances from his telecoms provider to ensure the messages were untraceable.
For the above reasons, the Commissioner is satisfied that this contravention was deliberate.
Further and in the alternative, the Commissioner has gone on to consider whether the contravention identified above was negligent. This consideration comprises two elements:
Firstly, he has considered whether KRA knew or ought reasonably to have known that there was a risk that these contraventions would 22FOR PUBLIC RELEASE occur. He is satisfied that this condition is met, for the following reasons:
The Commissioner has published detailed guidance for those carrying out direct marketing explaining their legal obligations under PECR. 8 This guidance gives clear advice regarding the requirements of consent for direct marketing and explains the circumstances under which organisations are able to carry out marketing over the phone, by text, by email, by post, or by fax. In particular it states that organisations can generally only send, or instigate, marketing messages to individuals if that person has specifically consented to receiving them; and highlights the difficulties of relying on indirect consent for electronic mail. The Commissioner has also published detailed guidance on consent under the UK GDPR. In case organisations remain unclear on their obligations, the ICO operates a telephone helpline. ICO communications about previous enforcement action where businesses have not complied with PECR are also readily available via the ICO website.
It is therefore reasonable to suppose that KRA should have been aware of its responsibilities in this area.
Secondly, the Commissioner has gone on to consider whether KRA failed to take reasonable steps to prevent the contraventions. Again, he is satisfied that this condition is met.
The Commissioner’s direct marketing guidance makes clear that organisations acquiring and utilising marketing lists from a third party must undertake rigorous checks to satisfy themselves that the personal 8 Guide to Privacy and Electronic Communications Regulations | ICO 23FOR PUBLIC RELEASE data was obtained fairly and lawfully, and that they have the necessary 9 specific and recent consent. It is not acceptable to rely on assurances given by third party suppliers without undertaking proper due diligence.
There Commissioner found no evidence that KRA took reasonable steps to prevent the contraventions.
In the circumstances, the Commissioner is satisfied that KRA failed to take reasonable steps to prevent the contraventions.
The Commissioner is therefore satisfied that condition (b) from section 55A (1) DPA is met. The Commissioner’s decision to issue a monetary penalty
The Commissioner has taken into account the following aggravating features of this case: • The company concealed their identity by using generic trading names, anonymous websites and a telecoms provider in China who assured them their messages were untraceable. • The messages were targeted at people who had been turned down for loans who were likely to be particularly vulnerable to predatory marketing messages promoting debt solutions. • The company also sent fake bailiff messages to pressurise prospective customers to respond to the marketing texts and to provide the relevant documentation. These messages caused substantial distress to recipients who were already vulnerable. 9 Using marketing lists | ICO 24FOR PUBLIC RELEASE • The company provided debt advice to individuals despite not being registered with the FCA. They used persuasive language to promote products which were not necessarily in the customer’s best interests without fully explaining the risks involved. This is likely to have caused financial damage to customers who may have been better off with another form of debt solution. • Ahmad lied to ICO officers during the execution of the search warrant by claiming KRA only sent text messages to people who had opted in and were giving people options rather than providing debt advice. • During the execution of the warrant, Ahmad stated an intention to become compliant and committed to making contact with the ICO. To date, no such contact has been made. • Ahmad was uncooperative and obstructive during the warrant, deliberately concealing his mobile phone in an attempt to withhold evidence. • KRA resumed their unlawful marketing activity following the warrant, resulting in further complaints to the 7726 spam reporting service in September and October 2025.
The Commissioner has taken into account the following mitigating features of this case: • The Commissioner has found no evidence of any mitigating factors.
For the reasons explained above, the Commissioner is satisfied that the conditions from section 55A (1) DPA have been met in this case. He is also satisfied that the procedural rights under section 55B have been complied with. 25FOR PUBLIC RELEASE
The latter has included the issuing of a Notice of Intent, in which the Commissioner set out his preliminary thinking. In reaching his final view, the Commissioner has taken into account the representations made by KRA on this matter.
The Commissioner is accordingly entitled to issue a monetary penalty in this case.
The Commissioner has considered whether, in the circumstances, he should exercise his discretion so as to issue a monetary penalty.
The Commissioner has considered the likely impact of a monetary penalty on KRA. He has decided on the information that is available to him, that a penalty remains the appropriate course of action in the circumstances of this case.
The Commissioner’s underlying objective in imposing a Monetary Penalty Notice is to promote compliance with PECR. The sending of unsolicited direct marketing messages is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a deterrent against non-compliance, on the part of all persons running businesses currently engaging in these practices. The issuing of a monetary penalty will reinforce the need for businesses to ensure that they are only messaging those who specifically consent to receive direct marketing.
In making his decision, the Commissioner has also had regard to the factors set out in s108(2)(b) of the Deregulation Act 2015; including: the nature and level of risks associated with non-compliance, including the risks to economic growth; the steps taken by the business to 26FOR PUBLIC RELEASE achieve compliance and reasons for its failure; the willingness and ability of the business to address non-compliance; the likely impact of the proposed intervention on the business, and the likely impact of the proposed intervention on the wider business community, both in terms of deterring non-compliance and economic benefits to legitimate businesses.
For these reasons, the Commissioner has decided to issue a monetary penalty in this case. The amount of the penalty
Taking into account all of the above, the Commissioner has provisionally decided that a penalty in the sum of £300,000 (three hundred thousand pounds) is reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty. Conclusion and right of appeal 104. The monetary penalty must be paid to the Commissioner’s office by BACS transfer or cheque by 20 June 2026 at the latest. The monetary penalty is not kept by the Commissioner but will be paid into the Consolidated Fund which is the Government’s general bank account at the Bank of England.
If the Commissioner receives full payment of the monetary penalty by 19 June 2026 the Commissioner will reduce the monetary penalty by 20% to £240,000 (two hundred and forty thousand pounds). However, you should be aware that the early payment discount is not available if you decide to exercise your right of appeal. 27FOR PUBLIC RELEASE
There is a right of appeal to the First-tier Tribunal (General Regulatory Chamber) against: (a) the imposition of the monetary penalty and/or; (b) the amount of the penalty specified in the Monetary Penalty Notice.
Any notice of appeal should be received by the Tribunal within 28 days of the date of this Notice.
Information about appeals is set out in Annex 1.
The Commissioner will not take action to enforce a monetary penalty unless: • the period specified within the Monetary Penalty Notice within which a monetary penalty must be paid has expired and all or any of the monetary penalty has not been paid; • all relevant appeals against the Monetary Penalty Notice and any variation of it have either been decided or withdrawn; and • the period for appealing against the monetary penalty and any variation of it has expired.
In England, Wales and Northern Ireland, the monetary penalty is recoverable by Order of the County Court or the High Court. In Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland. 28FOR PUBLIC RELEASE Dated the 20th day of May 2026 Andy Curry Head of Investigations Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF 29FOR PUBLIC RELEASE Annex SECTION 55 A - E OF THE DATA PROTECTION ACT 1998 RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER Section 55B(5) of the DPA gives any person upon whom a Monetary Penalty Notice has been served a right of appeal to the First-tier Tribunal (General Regulatory Chamber) (the “Tribunal”) against the Notice. If you decide to appeal and if the Tribunal considers:- a) that the Notice against which the appeal is brought is not in accordance with the law; or, b) to the extent that the Notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal will allow the appeal or substitute such other decision as could have been made by the Commissioner. In any other case the Tribunal will dismiss the appeal. You may bring an appeal by serving a notice of appeal on the Tribunal at the following address: General Regulatory Chamber HM Courts and Tribunals Service PO Box 11230 Leicester LE1 8FQ Telephone: 0300 123 4504 Email: grc@justice.gov.uk 30FOR PUBLIC RELEASE The notice of appeal should be sent so it is received by the Tribunal within 28 days of the date of the Monetary Penalty Notice. If your notice of appeal is late the Tribunal will not admit it unless the Tribunal has extended the time for complying with this rule. The notice of appeal should state:- a) your name and address/name and address of your representative (if any); b) an address where documents may be sent or delivered to you; c) the name and address of the Information Commissioner; d) details of the decision to which the proceedings relate; e) the result that you are seeking; f) the grounds on which you rely; g) you must provide with the notice of appeal a copy of the monetary penalty notice or variation notice; h) if you have exceeded the time limit mentioned above the notice of appeal must include a request for an extension of time and the reason why the notice of appeal was not provided in time. 31FOR PUBLIC RELEASE Before deciding whether or not to appeal you may wish to consult your solicitor or another adviser. At the hearing of an appeal a party may conduct his case himself or may be represented by any person whom he may appoint for that purpose. The statutory provisions concerning appeals to the First-tier Tribunal (Information Rights) are contained in section 55B(5) of, and Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 1976 (L.20)). 32