Local authorities face fines of up to £18m for breaching new data protection laws, councils have been warned.

A briefing note on the General Data Protection Regulations by the Local Government Association warned that under the new regime – to be introduced from May 2018 – public bodies could be fined up to €10m for basic security breaches and up to €20m for breaches of data protection principles, an individual's rights or international transfer restrictions. The current maximum fine under the Data Protection Act 1998 is £500,000.