"We are surprised and disappointed in this initial finding," British Airways CEO Alex Cruz said in a statement.

"British Airways responded quickly to a criminal act to steal customers' data. We have found no evidence of fraud [or] fraudulent activity on accounts linked to the theft," he added.

"People's personal data is just that — personal. When an organization fails to protect it from loss, damage or theft it is more than an inconvenience," Information Commissioner Elizabeth Denham said in a statement. "That's why the law is clear — when you are entrusted with personal data you must look after it."

Gita Shivarattan, data protection counsel at law firm Ashurst, said the proposed fine showed that "European data protection regulators are clearly ramping up fines for data breaches."

"It reflects the seriousness of the regulators where there is a significant breach of GDPR obligations," added Shivarattan.

— Hadas Gold contributed reporting.