What happens when business negligence causes serious harm to thousands of people? If a faulty ladder injures someone, directors face prison time. If forty million people have their data stolen due to poor security, they receive a strongly worded letter. In this provocative first episode of our two-part series, Noel and Mauven examine the shocking disparity between health and safety enforcement and cybersecurity regulation in the UK. We compare the HSE's tough approach (prison sentences, director liability, millions in fines) with the ICO's gentle touch (guidance, occasional fines, zero criminal consequences). With 40 million voter records compromised at the Electoral Commission resulting in just a formal reprimand, whilst construction directors regularly face 18-month prison sentences for single workplace accidents, we ask the uncomfortable question: why is cybersecurity enforcement essentially performative? This isn't anti-business rhetoric. This is an evidence-based examination of a broken system that fails to protect either businesses or the public, presented through statistics, case studies, and historical precedent, which demonstrates that personal accountability is effective. What You'll Learn The Two Regulators: A Tale of Vastly Different Consequences Why HSE directors face up to 2 years imprisonment, whilst the ICO never imposes criminal penalties How HSE issued 13,424 enforcement notices and 399 prosecutions in 2023-24 Why the ICO issued just £2.7 million in total UK fines, whilst EU regulators issued over £1 billion The legal frameworks that create this enforcement gap The Public-Private Accountability Divide Electoral Commission breach: 40 million records compromised, 14 months of hostile state access, consequence: formal reprimand Construction site failures: single injuries lead to prison sentences and director disqualifications Why do government organisations face minimal consequences for security failures The message this sends about who matters and who doesn't Historical Context: How HSE Transformed Workplace Safety 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974 How personal criminal liability changed director behaviour overnight The construction industry transformation from dangerous to safety-conscious Evidence that accountability actually works when properly enforced Arguments Against Director Liability (And Why They Fail) "Security is too complex for criminal standards" - why doesn't this hold up "Small businesses can't afford proper security" - HSE already handles proportionate enforcement "Innovation will suffer" - data showing the opposite effect in the safety sector "Current system works fine" - statistics proving it demonstrably doesn't The Current State of Inertia Why ICO enforcement focuses on "guidance and support" over punishment Political pressure keeps cybersecurity consequences minimal Business lobby resistance to accountability measures The broken incentive structure that rewards negligence Key Statistics Referenced HSE Enforcement 2023-24: 13,424 enforcement notices issued 399 prosecutions brought £73.8 million in fines Regular prison sentences (average 12-18 months for serious breaches) ICO Enforcement 2023-24: £2.7 million total fines across all UK GDPR violations Zero prison sentences imposed Zero director disqualifications Focus on "guidance and support" over punishment Electoral Commission Breach: 40 million UK voter records compromised The hostile state actor maintained access for 14 months Basic security failures: poor patching, weak passwords, inadequate monitoring Consequence: Formal reprimand only Impact Statistics: 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974 EU regulators issued over £1 billion in GDPR fines (vs the UK's £2.7 million) Keymark Construction director: 18 months' prison for fatal fall (2023) Notable Cases Discussed Health and Safety Enforcement Keymark Construction (2023): Director sentenced to 18 months imprisonment following fatal fall due to inadequate safety measures Corporate Manslaughter Act 2007: Multiple organisations convicted when management failures caused death Cybersecurity Non-Enforcement Electoral Commission (2023-24): 40 million voter records compromised by hostile state actor, 14 months of system access, consequence was formal reprimand with no financial penalty or personal liability British Airways GDPR Fine: Initially £183 million, reduced to £20 million, no director consequences despite preventable security failures Why This Matters for Small Businesses This isn't about attacking business owners. It's about exposing a system that fails everyone: Honest businesses suffer when competitors cut security corners without consequences Directors lack incentive to invest in security when breaches only result in fines the company pays Small businesses become collateral damage when larger organisations treat security as optional The current approach demonstrably doesn't work - breaches increase year on year despite ICO "guidance" Understanding this enforcement gap helps you see why cybersecurity culture hasn't undergone the same transformation as workplace safety culture. Part 2 will explore what accountability with teeth would actually look like, and how to protect SMEs whilst implementing it. Resources Mentioned HSE Annual Report 2023-24: Full enforcement statistics and prosecution details ICO Enforcement Data: Annual reports showing UK GDPR fine totals Health and Safety at Work Act 1974: Foundation legislation that transformed UK workplace safety Corporate Manslaughter and Corporate Homicide Act 2007: Criminal liability framework for organisations Electoral Commission Breach Report: Technical details of 14-month compromise EU GDPR Enforcement Tracker: Comparison of UK vs European enforcement approaches Hosts Noel Bradford 40+ years in IT/Cybersecurity across enterprise and SMB sectors. Former Intel, Disney, BBC. Current CIO/Head of Technology for boutique security-first MSP. Brings enterprise-level knowledge to small business constraints. Mauven MacLeod Ex-NCSC Government Cybersecurity Analyst with deep threat intelligence expertise. Glasgow-based security professional who translates complex government-level security concepts into practical SMB advice. Coming in Part 2 "What If Cyber Had Corporate Manslaughter? The Case for Personal Liability" We'll explore: Specific legislative framework for "Corporate Cyber Manslaughter" SME protection mechanisms (proportionate thresholds) How other countries successfully implement director liability Expected cultural transformations Practical compliance guidance What "reasonable care" actually means for small businesses Take Action Share Your Thoughts: Should directors face criminal liability for gross cybersecurity negligence? Comment on our website or social media. Prepare for Part 2: Start thinking about what security measures you currently have in place. Could you demonstrate "reasonable care" if asked? Review Your Security: Whilst we wait for better enforcement, don't wait to improve your security. Free resources available from NCSC. Subscribe: Make sure you don't miss Part 2, where we build the case for what enforcement with teeth would actually look like. Forward This Episode: Every business owner needs to understand why the current system fails them. Episode Details Runtime: 42 minutes Release Date: November 17th 2025 Series: Part 1 of 2 Category: Cybersecurity, Business, Technology, Policy Content Warning: Discussion of regulatory failures, system criticism, and calls for significant policy change. Evidence-based but provocative examination of current enforcement approaches. Connect With Us Website: thesmallbusinesscybersecurityguy.co.uk LinkedIn: [The Small Business Cyber Security Guy] Email: [email protected] Tags #Cybersecurity #SmallBusiness #UKBusiness #DataProtection #ICO #HSE #RegulatoryEnforcement #DirectorLiability #GDPR #BusinessSecurity #CyberAccountability #SecurityPolicy #UKRegulation #DataBreach #ElectoralCommission #CorporateManslaughter #BusinessCompliance #CyberGovernance #SecurityLeadership #RiskManagement Transcript Full episode transcript available on our website at thesmallbusinesscybersecurityguy.co.uk Support the Show If this episode opened your eyes to the enforcement gap, please: Leave a 5-star review on Apple Podcasts Share with business owners in your network Follow us on LinkedIn for ongoing discussion Subscribe to ensure you catch Part 2 Next Episode: Part 2 - What If Cyber Had Corporate Manslaughter? All Episodes: thesmallbusinesscybersecurityguy.co.uk/podcasts The Small Business Cybersecurity Guy Podcast offers practical, actionable cybersecurity advice for UK small businesses. We translate enterprise-grade security into affordable, implementable solutions for businesses with 5-50 employees. Disclaimer: This podcast provides general information and discussion about cybersecurity and business topics. This is not intended as legal, regulatory, or professional advice. Listeners should consult qualified professionals for personalised guidance tailored to their specific circumstances. © 2025 The Small Business Cyber Security Guy. All rights reserved.

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related