https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/enforcement-of-this-code/#:~:text=For serious breaches of the,risk-based approach to enforcement.
Anyone who has had the email fancy reporting it?