What happens when an organisation refuses to comply with the data protection principles?

Most organisations agree to put problems right when the IC brings them to their attention. If they do not, the IC may consider taking formal legal action such as issuing an enforcement notice ordering them to do so. The IC will take a range of factors into account in deciding whether to issue a notice. These will include the seriousness of the problem, any damage or distress you or anyone else might have suffered and the cost to the organisation of putting problems right. An enforcement notice is a legally binding document that sets out what an organisation must do (or stop doing) to comply with the law.