What does the ICO's action against the Met Police mean for choosing your suppliers?

What happened at the Met?

According to the ICO, Met officers and staff used an unapproved retail crime intelligence sharing platform between March 2023 and September 2024. Around 500 accounts were created and 375 were actively used. Between January and September 2024, personal information about 179 people, three of them under 18, was uploaded to help identify people suspected of shoplifting. That included names, dates of birth and, in a small number of cases, home addresses.

The ICO found that the force:

• processed personal information unlawfully, without consent and where sharing was not necessary for law enforcement purposes
• did not have appropriate measures in place to protect the information or to make sure its approval process for third-party technology was followed
• did not complete a data protection impact assessment (DPIA) before high-risk processing
• still had not done enough to make sure only approved third-party technology is used

The Met suspended the platform in September 2024 and brought it back in January 2026 with stronger governance, staff training, formal contractual controls and a completed DPIA. The ICO still decided action was needed on the wider question of how the force approves outside services. The enforcement notice requires it to strengthen how it identifies, assesses and approves third-party services, review its controls, improve staff awareness and regularly test that its measures work.

A reprimand is not a fine, but the enforcement notice sets out what must change.

Why it matters beyond policing

David Doodson, the ICO's Head of Investigations, said the action "should send a message across the policing sector, and beyond", and that before introducing new systems or platforms, organisations "must properly assess the risks, put appropriate safeguards in place and ensure effective oversight."

That applies to plenty of everyday suppliers, not just software. A shredding company holding sacks of patient letters, payroll records or HR files is handling personal information on your behalf. So is whoever takes away old laptops and hard drives. If one of them gets it wrong, the ICO's guidance is clear that the responsibility still sits with you as the organisation in control of the data.

What does UK guidance expect when you use a supplier?

The ICO's guidance on controllers and processors says you must only use a processor that can show it has the expertise, resources and reliability to protect personal information properly. Once you have chosen one, you need a written contract, and the UK GDPR sets out minimum terms, including:

• processing only on your documented instructions
• confidentiality commitments from the supplier's staff
• appropriate security measures
• rules on using subcontractors
• what happens to the data at the end of the contract
• your right to audits and inspections

Your job does not end at signing. The ICO says you should keep checking that the supplier is doing what it agreed. Its disposal checklists also expect contracts with disposal providers to cover security, accountability and your right to audit, and expect you to get evidence, such as destruction certificates, that the waste was actually destroyed. Our guide to what the ICO expects when you dispose of confidential waste goes through those checklists in plain English.

What this means for your business

The Met had a platform in use before anyone approved it. The disposal version of that is a cleaner, an office manager or a site lead booking whoever is cheapest or closest, with no one checking first. A short supplier checklist closes that gap.

1. Know who handles your waste. List every company that collects paper, devices or media from any of your sites, including one-off clearances and office moves.
2. Approve before you book. Make one person or team responsible for signing off a disposal supplier before it is used, the same way you would approve software.
3. Put it in writing. Make sure the contract covers security, confidentiality, subcontracting, your right to audit and proof of destruction.
4. Match records to collections. Keep a log of what goes out, and check every destruction record against it.
5. Review it regularly. Check suppliers again when contracts renew or when what you send them changes, for example a move from paper to devices.

Frequently asked questions