GRC

ICO orders Met Police to fix shadow IT after Auror data sharing

ICO reprimands the Met and serves an enforcement notice after officers used unapproved platform Auror to share data on 179 people.

Scales of justice graphic with the headline ICO orders Met to fix shadow IT

The UK data protection regulator has reprimanded the Metropolitan Police and served an enforcement notice after officers used an unapproved retail crime platform to share details of suspected shoplifters. The case is a textbook example of shadow IT, and the regulator says the underlying control failure is still not fixed.

What happened

On 14 October 2026 the ICO published a combined reprimand and enforcement notice against the Metropolitan Police Service (MPS). The notice itself was issued on 23 September 2026, a week before the ICO’s statutory powers passed to the new Information Commission on 30 September, so it was issued under the Information Commissioner’s delegated authority rather than by the new body.

The investigation centred on Auror, a cloud platform that retailers use to log incidents such as shoplifting and to share reports, images and CCTV with police. According to the ICO, Met officers and staff used it from March 2023 to September 2024 even though the force had never formally approved it. Roughly 500 accounts were opened and 375 of them saw active use.

Between January and September 2024, data on 179 people was uploaded while officers tried to identify shoplifting suspects. Three of those people were under 18.

The regulator found four infringements. The Met processed personal data unlawfully, without consent and where sharing was not needed for law enforcement purposes. It did not have suitable technical and organisational measures in place, and did not follow its own approval route for third-party technology. It skipped the data protection impact assessment (DPIA) that high-risk processing requires. Most significantly, the ICO concluded the force is still failing to ensure that only approved third-party tools handle personal data.

The detail

The Register reports that two internal security incident reports were raised in August and September 2024. One concerned an officer naming suspects recognised from retailer CCTV. The other flagged officers pulling CCTV from the platform when it had not been cleared by the force’s cyber security team. Access was blocked on 26 September 2024. The Met’s data protection officer told the ICO about the force’s use of Auror in December 2024, during a discussion about a separate matter, and a formal investigation began in April 2025.

The ICO’s criticism of the controls is pointed. It said the force relied too heavily on soft measures such as policy reminders and training, rather than technical blocks. It also said the Met had not tested whether its web filtering worked, given that officers used the service for over 18 months without a single alert being triggered.

The Met suspended the platform in September 2024 and brought it back in January 2026 after adding governance, training, contractual controls and a completed DPIA. A Met spokesperson told The Register the force accepts the findings and that, after formal approval and a pilot, officers in 14 London boroughs now use the platform. The ICO acknowledged those improvements but still judged enforcement necessary because the wider weakness around third-party technology remains.

The enforcement notice requires the Met to improve how it identifies, assesses and approves third-party services, review its controls, tighten governance, raise staff awareness, test its measures regularly and send the regulator periodic progress updates.

Timeline of the Met Police Auror case from first use in March 2023 to the ICO enforcement notice in September 2026

Why it matters for UK organisations

Strip away the uniforms and this is a very ordinary story: a free, useful cloud service, pushed by a business partner, adopted by front-line staff without anyone in security or data protection signing it off. Most organisations have a version of this risk, and less visibility than they think.

The regulator’s language is a warning to everyone. ICO head of investigations David Doodson said organisations “cannot allow innovation to outpace their data protection responsibilities”, and that the message was meant for policing “and beyond”. The finding that the failure is ongoing is the key detail. The ICO is not only punishing past behaviour, it is saying a policy without working technical enforcement is not an appropriate measure under data protection law.

There is also a point about penalties. The outcome fits the ICO’s stated public sector approach, confirmed in late 2025, of favouring reprimands and enforcement notices and keeping fines for the most serious cases. Private sector organisations should not assume the same restraint.

Generative AI sharpens the point, since staff can paste personal data into browser-based AI tools in seconds. If a large, well-resourced force could miss 375 active accounts on one platform for a year and a half, most organisations should assume they have similar blind spots today.

Expert view

When we test organisations, unsanctioned SaaS is one of the most consistent findings, and it is almost never malicious. People use tools that help them do their jobs. The issue is that a policy telling staff not to do something is not a control. If nobody is checking egress logs, DNS records or identity provider sign-ins for unknown services, the policy is just a document.

What stands out here is the testing gap. Many organisations have web filtering and assume it works. In my experience, category-based blocking regularly misses newer or niche services, and personal or free accounts created with a work email sit completely outside the corporate identity platform. The ICO’s point that nobody noticed for 18 months is the real lesson. Controls that are never tested tend to drift into fiction.

The route to discovery is also telling. Internal incident reports did their job, yet months passed before the regulator heard about it, which suggests a weak link between security incident handling and data protection governance.

What to do now

  1. Find your shadow SaaS. Review proxy, DNS, firewall and CASB logs for cloud services that are not on your approved list. Pay particular attention to services adopted at the request of partners, customers or suppliers.
  2. Move from soft to hard controls. Back up acceptable use policy with technical enforcement: block or restrict unapproved services, and require single sign-on for anything that handles personal data. This maps directly to the Cyber Essentials secure configuration and user access control requirements.
  3. Test that the blocks work. Schedule regular checks, for example during penetration tests, to confirm unapproved services are actually blocked and that attempts raise alerts.
  4. Make DPIAs a gate, not paperwork. No new system that processes personal data, especially data on children or suspects, should go live without a completed DPIA and a data sharing agreement where third parties are involved.
  5. Join up security and data protection. Ensure security incident reports involving personal data reach the DPO quickly, with a clear decision record on whether regulator notification is needed.
  6. Cover AI tools explicitly. Extend your third-party approval process to generative AI services and browser extensions, and give staff an approved alternative.

Bottom line

This was not a hack, and no attacker was involved. It was a governance failure that let a useful tool become an unlawful one. The ICO has made clear that policies without tested technical controls will not satisfy the law, and that message applies to every UK organisation whose staff can sign up for a cloud service with a work email address.

Sources

Related Posts