Recent research by the Department for Science, Innovation and Technology found that 31% of UK businesses are not confident in storing or transferring personal data securely. 

This is demonstrated by new data analysis by cyber security experts at Bridewell, which revealed that over 26,000 data breaches as a result of human error have been reported to the Information Commissioner’s Office (ICO) since 2020.

The Information Commissioner’s Office, the UK regulator for upholding data privacy, has enforcement powers ranging from monetary penalties, enforcement notices, reprimands and even prosecuting individuals and organisations for serious data protection breaches. 

Between 2020 and 2025, the top five causes of human-error-related data breaches have been data emailed to the wrong recipient, data posted or faxed to the wrong recipient, failure to redact information, failure to use bcc and the verbal disclosure of personal data. Between 2020 and 2025, human-related breaches rose from 3,847 to 5,496, a 43 percent increase.

The biggest cause by far is emailing data to the wrong recipient, with 11,214 breaches reported since 2020. These incidents have risen from 1,519 in 2020 to 2,459 in 2025, an increase of 62 percent.

This is followed by data being incorrectly posted or faxed to the wrong recipient. Between 2020 and 2025, 4,750 incidents of this nature were reported. Failure to redact information was reported in 3,353 incidents, while failure to bcc was reported in 2,060 incidents. The verbal disclosure of personal data was reported in 1,826 incidents.

The data shows the health industry has the most incidents as a result of human error, with 5,054 reported between 2020 and 2025. The exposed data included personal identifiers, criminal convictions or offences, health data, and economic and financial data, highlighting the risk of this sensitive information falling into the wrong hands. 

The local government and education and childcare sectors were also responsible for a high number of incidents. Organisations in the education and childcare sector reported  4,180 data security incidents, while the local government sector reported 3,457.

Many damaging data breaches in recent years started with information being shared in error. In one case, an official from the Ministry of Defence inadvertently exposed a spreadsheet with data containing personal details of nearly 19,000 applicants to the Afghan Relocations and Assistance Policy. A Defence Committee report released in July found that the breach stemmed from several failings, including a reliance on inappropriate tools, weak operating procedures, insufficient training and an inadequate culture of data protection.

The data also shows how quickly organisations report these breaches. Of the 26,364 incidents with a recorded reporting time, the largest share (10,077, or 38 percent) were reported between 24 and 72 hours after discovery, while 6,770 (26 percent) were reported in less than 24 hours.

This shows that a majority (64 percent) were reported within 72 hours, the deadline set under UK GDPR for notifying the ICO of a reportable breach. However, more than a third (36 percent) fell outside this window: 5,165 incidents (20 percent) took between 72 hours and a week to report, and 4,352 (17 percent) took more than a week.

Missing the 72-hour window can come with serious consequences. Organisations that report late must justify the delay to the ICO, and failing to notify properly can lead to fines of up to £8.7 million or 2 per cent of global annual turnover, depending of global annual turnover, dependent on which is higher. Delays also harm the people affected, leaving them unaware their data has been exposed and unable to protect themselves by changing passwords or alerting their bank.

Recommended reading

• Report: Cyber Breaches Are Tanking Share Prices
• Human Error Costing UK Business Billions in Data Breach Losses
• Inside the Aftermath: What Really Happens When You Get Hacked
• Report: 93% of Data Breaches Expose Financial Records

“The scale of these incidents highlights how challenging it is for organisations to support employees in handling personal data safely,” Chris Linnell, Associate Director of Data Privacy, said.

“Many data breaches often don’t stem from malicious behaviour, but rather from simple mistakes in busy working environments.

“It’s important for organisations to ensure employees understand their responsibilities and have the practical skills, clear processes, and the right tools to minimise risk.

“Regular, scenario-based training that reflects day-to-day work is also likely to offer greater value than annual e-training sessions, as they help employees recognise risks in context and handle personal data with confidence.

“However, training alone is not enough. Organisations should also simplify and automate processes as much as possible to reduce complexity while still maintaining the integrity of the data. Technical controls such as data loss prevention policies, recipient validation checks, encryption, and ‘nudge’ technologies can provide timely prompts that encourage employees to pause, sense-check their actions before sharing information.

“Finally, a well-tested incident response process and a strong no-blame reporting culture are essential. When employees feel confident that they will be supported rather than criticised, organisations are more likely to identify incidents quickly, limit their impact, and learn from them to prevent future occurrences.”