On October 30, 2018, the Information Commissioner’s Office (ICO) released an enforcement notice addressed to AggregateIQ Data Services Ltd (AIQ), in its capacity as a data controller under both the new Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR). The ICO derived its mandate for the issuance of the enforcement notice under Section 150(2) of the DPA.