Free to use, never approved: what the ICO's ruling against the Met means for your business

· · Security

Somebody in your business has an account on a platform nobody approved. Often it was not even their idea. A customer asked them to log in to its portal, a partner sent an invitation, a supplier said "just upload it here". The account was free, it made the job easier, and personal data started going into it before anyone asked whether it should.

That is the situation the UK data protection regulator has just taken enforcement action over, and the organisation on the receiving end is the Metropolitan Police.

What happened at the Met

Between March 2023 and September 2024, Met officers and staff used Auror, a platform retailers use to share shoplifting reports and CCTV footage. The force had never approved it. According to the ICO's announcement, around 500 accounts were created and 375 were actively used. Between January and September 2024, officers uploaded personal information about 179 people, three of them under 18: names, dates of birth, and in a few cases home addresses.

Nobody set out to break the rules. The Register reports that retailers encouraged officers onto the platform to get at CCTV footage, and that police accounts were free. The Met itself says officers were "using the platform in good faith". It was a useful tool that arrived through a partner, which is exactly how this happens in a business too.

The ICO issued a reprimand and an enforcement notice. Its findings are worth reading slowly, because none of them is specific to policing. The force failed to complete a data protection impact assessment before high-risk processing. It failed to make sure its approval process for third-party technology was followed. And it still had not shown it could ensure that only approved tools are used.

The part that should worry you most

Two details from the case apply directly to a business of 30 people.

First, the Met relied on what The Register describes as "soft controls": policy reminders and staff training. The ICO's view was that these often go unnoticed, and that technical measures were needed as well. Most smaller businesses rely entirely on soft controls. There is a line in the handbook, and that is the whole defence.

Second, the force had not tested whether the controls it did have actually worked. Officers used the platform for more than 18 months without anything raising an alert. What surfaced it in the end was two internal incident reports from officers, and the ICO only learned of it when the Met's data protection officer mentioned it during a conversation about something else.

Notice also what the ICO did not accept as an answer. The Met suspended the platform, did the checks, and reintroduced it in January 2026 with a proper assessment and contract in place. The regulator still took action, because fixing one tool is not the same as having a process that catches the next one.

As the ICO's head of investigations, David Doodson, put it: "if you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset."

What "reasonable steps" look like for a smaller business

You do not need the Met's bureaucracy. You need a small, real version of each thing the ICO found missing.

For the director, the decisions:

  • Decide who says yes. Name one person who approves any new tool that will hold customer, staff, or supplier personal data. Without a named person, the answer defaults to whoever signed up first.
  • Make the assessment proportionate, but make it happen. A data protection impact assessment is a written check, done before you start, of what personal data a new system will hold, what could go wrong, and what you will do about it. For most SME tools it is a page or two. The ICO's guidance on impact assessments explains when one is required.
  • Treat partner platforms as your problem too. If a customer or supplier asks your team to put personal data into their system, you are still responsible for your decision to share it. "They asked us to" is not an assessment.

For whoever looks after IT, the checklist:

  • Find out what is already in use. Ask the team which outside platforms, portals, and apps they log in to for work, especially free ones and ones a customer set up. Ask it as a question, not an accusation, or you will not get the true list.
  • Keep an approved-tools list. One page: the tool, what data goes into it, who approved it, and when. This is the evidence that you took reasonable steps if anything ever goes wrong.
  • Add one technical control. In Microsoft 365 or Google Workspace, stop staff granting third-party apps access to company accounts without approval. It will not catch everything, but it moves you beyond policy alone.
  • Test it once. Pick a tool that is not on the list and see whether anything would have told you someone was using it. If the answer is no, you have found the same gap the Met had.

None of this is a large project. The real cost lies in not knowing, and in an 18-month gap between the first upload and the first question.

How Steelwise can help

Working out which platforms your team already uses, which hold personal data, and what a proportionate approval process looks like for a business your size is a short piece of work. Get in touch if you would like a hand with it.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.