DSG Retail Limited v The Information Commissioner

This case is about the scope of a business’s duty to protect personal data from cyber risks. The Court of Appeal looked at the old Data Protection Act 1998 and asked whether a company had to protect data that were personal data to the company, even if an attacker who obtained that data could not identify the individuals from the stolen data alone.

The court said yes. If the information is personal data from the controller’s perspective, the security duty can apply. The duty is about safeguarding personal data you control with appropriate technical and organisational measures.

That does not mean a business guarantees that no incident will ever happen. The court was clear that this is a proportionate duty to guard against risk. But it does mean a business cannot shrink the duty by focusing only on what the attacker could identify from one slice of stolen data.

DSG Retail Limited owned and operated major retail brands including Dixons and Currys PC World. In 2017 to 2018, its systems were targeted in a cyber attack that lasted about nine months. The attackers scraped transaction details from point-of-sale terminals or card readers as transactions were made, stored the scraped data on DSG’s servers and attempted to exfiltrate it.

More than 5.6 million payment cards were affected. In around 8,000 cases, the attackers obtained the 16-digit card number, expiry date and cardholder name. But for the great majority of cards, because of the chip-and-pin system known as EMV, the attackers obtained only the card number and expiry date.

That distinction drove the legal dispute. On the assumptions used for the appeal, the attackers did not have the names or other information needed to identify the cardholders from the EMV data alone. DSG, however, could identify the individuals from its own wider records.

After investigating, the Information Commissioner concluded that DSG had breached the seventh data protection principle under the Data Protection Act 1998 and issued a monetary penalty notice for £500,000. DSG challenged that decision through the tribunal system.

The case then moved through three levels. The First-tier Tribunal rejected DSG’s narrow argument and upheld the penalty notice, although it reduced the penalty by half. The Upper Tribunal accepted DSG’s narrower reading of the duty. The Information Commissioner then appealed to the Court of Appeal on that single legal issue.

The issue before the Court of Appeal was narrow but important. Under the Data Protection Act 1998, the seventh data protection principle required appropriate technical and organisational measures against unauthorised or unlawful processing of personal data, and against accidental loss, destruction or damage.

The question was whether that duty only applied where the third party doing the unauthorised processing could itself identify the individuals from the data obtained. In other words, was the duty judged from the attacker’s perspective, or from the controller’s perspective?

DSG argued that if the attackers could not identify the cardholders from the EMV data, then the attackers were not processing personal data in the relevant sense, so the security duty did not extend that far. The Information Commissioner argued that this was too narrow and inconsistent with the structure and purpose of the legislation.

The court also made clear what it was not deciding. It was not deciding whether there was in fact a risk that attackers could identify cardholders by other means. It was not deciding whether DSG’s actual measures were appropriate. It was deciding only whether any duty at all could apply on the assumption that the cardholders were identifiable to DSG but not to the attackers.

The Court of Appeal allowed the Information Commissioner’s appeal. Lord Justice Warby, with Lady Justice Elisabeth Laing and Lord Justice Moylan agreeing, held that the Upper Tribunal’s narrow interpretation was wrong.

The court described the security duty as a protective duty, or safeguarding duty. It requires a data controller to take proportionate steps to guard against risk. It is not a guarantee that no breach will ever happen. But it does apply to personal data for which the controller is responsible, even where the wrongdoer could not identify the individuals from the data obtained.

The court placed weight on the wording of section 4(4) of the 1998 Act, which imposed a duty on a data controller to comply with the data protection principles in relation to all personal data with respect to which it was the data controller. It also looked at the seventh principle itself, which required appropriate technical and organisational measures against unauthorised or unlawful processing of personal data.

In the court’s view, nothing in that wording justified cutting down the duty by asking whether the data would still count as personal data in the hands of the attacker. If the data were personal from the controller’s perspective, that was enough for the duty to arise.

The court also accepted that the narrower reading produced surprising consequences. On that approach, a business might have no duty to guard against malicious deletion, alteration, extraction or encryption of personal data where the attacker could not identify the individuals concerned. The court regarded that as inconsistent with the protective purpose of the legislation.

The court relied on the language, context and purpose of the legislation. It said the broader interpretation was more consistent with the wording of the 1998 Act and the Data Protection Directive that sat behind it.

One important point was the structure of the 1998 Act. The general duty applied to all personal data with respect to which the controller was the data controller. The court treated that as an unqualified starting point. It did not see wording in the seventh principle that cut the duty down by reference to the perspective of the wrongdoer.

The court also looked at the Directive. It noted that the Directive’s security provisions were aimed at protecting personal data against unauthorised disclosure, access and other unlawful forms of processing, taking account of the state of the art, implementation cost, the risks involved and the nature of the data to be protected.

The judgment stressed practical consequences too. On DSG’s reading, a business could fall outside the security duty in situations where attackers could not identify the people concerned but could still delete, alter, extract or encrypt the data. The court saw that as a serious gap that Parliament and the EU legislature were unlikely to have intended.

The court also considered earlier case law about anonymised data and freedom of information. It concluded that those authorities did not decide the issue in this appeal because they dealt with a different context, namely deliberate disclosure of data that had been rendered anonymous before release.

That mattered because this case was not about a controller intentionally creating a truly anonymised dataset and disclosing it. It was about whether a controller had any duty at all to protect personal data in its systems against unauthorised third-party processing. The court’s answer was clear. If the information remains personal data from the controller’s perspective, the security duty applies for so long as that remains true.

The appeal did not decide every issue in the wider enforcement action. The court was careful to limit itself to one point of legal principle.

It did not decide whether DSG’s actual technical and organisational measures were appropriate on the facts. It did not decide whether any breach was serious enough to justify a monetary penalty notice. And it did not decide whether the amount of any penalty was ultimately appropriate after applying the correct legal test.

Instead, the court allowed the appeal and remitted the matter to the First-tier Tribunal to be determined in accordance with its judgment. So this decision is important on legal interpretation, but it is not the final word on the underlying enforcement outcome.

The practical lesson is wider than payment card data. Many businesses hold information that may not identify a person on its own, but does identify them when combined with other records the business holds. That can include customer numbers, account references, transaction histories, booking records, device logs and internal identifiers.

This case says you should not assume those datasets fall outside your security duty just because an outsider who steals one slice of the data could not immediately name the person. If your business can identify the person from the data and related information in your systems, you should assume the data need appropriate protection.

The judgment is also useful because it links legal compliance with practical cyber security. The court did not prescribe a fixed control list. It focused on proportionate safeguarding measures, taking account of risk, the nature of the data, the state of technology and the cost of implementation.

That means the right question is usually not, could a hacker identify the customer from this field alone? The better question is, is this personal data in our environment, and what controls are appropriate to reduce the risk of unauthorised access, misuse, alteration, loss or destruction?

The judgment itself notes that the modern security duty now appears in GDPR and UK GDPR. This case is not a direct ruling on those regimes, but it is still a useful reminder that security obligations are framed broadly and are tied to the data you control, not just to the immediate usefulness of one stolen extract.

For a business owner or manager, this case is a prompt to check whether your data governance and cyber security work together. The court’s reasoning supports a joined-up approach rather than a narrow legal defence after an incident.

You should be able to show what personal data you hold, how individuals can be identified within your systems, what risks exist, and what technical and organisational measures you have chosen in response. That record matters because the duty is about appropriate measures, not just good intentions.

Even though the case arose from a large retailer and payment card environment, the same thinking applies to smaller businesses. If you hold customer account data, booking records, staff files or device-linked logs, you should know which of those records can be linked back to a person and how they are protected.

The judgment was handed down on 19 February 2026. The hearing took place on 4 December 2025. The case concerns a cyber attack in 2017 to 2018 and the security duty under the Data Protection Act 1998.

The court allowed the Information Commissioner’s appeal and remitted the matter to the First-tier Tribunal. That means the decision is authoritative on the legal interpretation point decided by the Court of Appeal, but it does not finally resolve the wider enforcement dispute.

The judgment itself notes that the modern security duty now appears in GDPR and UK GDPR. So while the ruling is about the 1998 Act, it remains useful when thinking about present-day security obligations at a high level.