The NIS Regulations : Monetary penalties of up to GBP 17 million can be incurred by RDSPs, depending on the severity of the infringement. 2.8 Enforcement : Please cite any specific examples of enforcement action taken in cases of non-compliance with the above-mentioned requirements. The largest penalty imposed by the ICO for an organisation's failures relating to data security was the GBP 20 million fine against British Airways in July 2019. In September 2018, British Airways notified the ICO of a cyber-incident in which user traffic to its website was diverted to a fraudulent site, through which the personal data (including names, addresses and payment details) of approximately 430,000 people was collected. The fine (reduced from GBP 189.39 million) was imposed on British Airways for its failure to employ adequate security measures despite the large amount of personal data collected daily through its websites.