A UK public body has a security breach, in which the details of a hundred...

The UK GDPR and the Data Protection Act 2018 set a maximum fine of £17.5 million or 4% of annual global turnover, whichever is higher, for infringements of the data protection principles, the rights of data subjects, or the rules on transfers of personal data to third countries. This is the higher maximum penalty that applies to the most serious breaches of the UK GDPR. A security breach that exposes the details of a hundred thousand members of the public would likely fall under this category, as it would compromise the confidentiality and integrity of personal data, and potentially cause significant harm and distress to the data subjects. Therefore, the maximum fine that the UK public body could receive for this breach is £17.5 million or 4% of gross annual turnover, whichever is higher. References:

Penalties3

GDPR Penalties & Fines4

Three years of GDPR: the biggest fines so far5