3.0s → 0.5s

response time

10 → 2

daily instances

120,000

searches each week

Challenge

When GDPR came into force, millions of organisations and citizens turned to the ICO for guidance. Almost overnight, its website became critical national infrastructure. The platform had to cope with unprecedented demand at the same time as it was adapting to a recent move to Microsoft Azure.

The surge exposed weaknesses in configuration, application performance and operational processes at the worst possible moment. During peak periods, response times slowed, infrastructure was urgently scaled just to stay online and the platform regularly expanded to nine or ten instances. CPU and memory ran close to capacity, forcing the ICO onto its highest service tier.

The operational impact was just as significant. Teams made hour-by-hour decisions about which areas of the site to suspend so essential guidance remained available. Every time users couldn't self-serve, routine enquiries reached support teams instead, increasing pressure on an organisation whose credibility depends on providing timely, reliable access to trusted information.

ICO’s immediate priority was to restore stability. Their longer-term goal was finding a partner who could improve a live public service whilst keeping it stable, combining engineering know-how, user-centred design, security and disciplined operational delivery.

Approach

Restore stability

We started by identifying the root causes of the platform’s instability. We reviewed the application, infrastructure and configuration from end to end, exposing the bottlenecks driving poor performance and unnecessary scaling.

Instead of attempting a high-risk replacement programme, we prioritised targeted improvements that could be released safely, measured in production and refined through evidence.

We tuned infrastructure, removed inefficient code and aligned platform capacity with real demand. As stability improved, firefighting reduced and the ICO team regained time to focus on higher-value work.

This work established the core principle of our partnership with ICO, to first build a dependable service then improve it continuously using evidence.

Design around evidence

Once the platform was stable, we worked alongside the ICO to understand how people actually used their website. Together we analysed usage data, ran user surveys and carried out moderated usability testing.

The research replaced assumptions with clear priorities for navigation, search and access to guidance, and allowed our engineers to experience user frustrations first-hand.

Build services, not just pages

With a stable platform in place, we shifted our focus from improving pages to improving services.

We introduced a paperless Direct Debit service that removed avoidable manual administration. We built secure, real-time processing for web form submissions, creating the foundation for automating routine processes such as contact detail updates.

We transformed the Subject Access Request journey, re-imagining a paper-based process into an efficient guided online service that users could complete in around ten minutes. Within two weeks, submissions had tripled and users rated the service 4.7 out of 5.

Make reliability repeatable

Long-term resilience depends on delivery as much as technology.

We introduced a mature software development lifecycle, including structured backlog management, sprint planning, controlled repositories, automated build and deployment pipelines, automated testing and continuous OWASP security scanning.

We made operational assurance part of everyday delivery rather than a periodic exercise, combining around-the-clock monitoring, routine infrastructure reviews and independent security audits into a comprehensive managed service.

Outcome

The ICO moved from managing platform capacity every day to running a service they and their users could rely on.

Response times fell from around three seconds to just 0.5 seconds. Peak infrastructure requirements dropped from as many as ten instances to two, reducing daily scaling by 80% while continuing to support around 120,000 searches every week.

The benefits extended well beyond performance. Automated deployments reduced release risk, continuous security testing strengthened operational resilience and the ICO gained a transparent, evidence-based way to balance business-as-usual delivery with ongoing service improvement.

Today, we continue to work as an integrated part of the ICO's digital team. Together, we've evolved a platform that remains resilient under national demand while creating the foundation for continuous improvement.

The result is more than a faster website. It's a dependable public service that gives users faster access to trusted guidance, frees specialist staff to focus where human expertise matters most and provides the ICO with a digital platform ready for whatever comes next.

Related content