The Information Commissioner will begin fining organisations for data breaches from April next year.
The move will hit businesses and government departments that are judged to have recklessly or deliberately mishandled data.
The powers will be introduced as part of the 2008 Criminal Justice and Immigration Act. The level of fines has not yet been decided but the Ministry of Justice is expected to announce details later this year.
A spokesperson at the Information Commissioner’s Office warned that the fines would be “substantial”.
“We are working with the Ministry of Justice to ensure that we can make use of this power as soon as possible, but do not expect this to be until early 2010,” the spokesperson said.
The proposed fining power was first announced by the government last November, following a review by Richard Thomas and Professor Mark Walport of medical research charity the Wellcome Trust that stated legislation on data protection was "deeply confusing".
Last month, outgoing Information Commissioner Richard Thomas repeated a call for better funding to help the ICO tackle more cases.
In other recent data protection developments, the ICO in June issued a guide on data protection to businesses. Separately, it also ordered the government to publish several Gateway Reviews on major IT projects, which revealed serious concerns on the schemes.
Rosemary Jay, a privacy law expert at Pinsent Masons, told OUT-LAW.COM it was "surprising" that the date was announced by the ICO and not by the Ministry of Justice.
"Data controllers should be warned that they cannot rely on this timetable," she said. "The date has not been announced or confirmed by the relevant Government department, the Ministry of Justice; the date of commencement is in the hands of Parliament and the Government not the ICO."
"The position is complicated by the fact that the power to fine cannot be brought in until all the preparatory work has been completed and a Code of Practice issued," she said.
"The ICO will of course have been working behind the scenes with the Ministry and will be aware of the proposed timetable but timetables can slip, events can intervene and there can be no certainty until Parliament has agreed the commencement order."
Find your next job with computerworld UK jobs