From today, section 250 of the Crime and Policing Act 2026 means that if a senior manager commits any criminal offence while acting within their actual or apparent authority, the organisation is also guilty of that offence.
This replaces the narrower test for economic crimes introduced by the Economic Crime and Corporate Transparency Act 2023. There is no “adequate procedures” defence.
Relevant offences include
- Computer Misuse Act 1990 offences.
- Data Protection Act 2018 offences, such as section 170 (unlawfully obtaining personal data) and section 173 (altering or destroying data to prevent disclosure in response to a subject access request).
Clear definitions of authority, strong access controls, monitoring and a culture where concerns can be raised safely are now even more important in preventing corporate liability.
Source: Crime and Policing Act 2026, section 250 (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
