Human-error data breaches in the UK rise 43% since 2020

UK organisations reported more than 26,000 human-error data breaches to the Information Commissioner's Office between 2020 and 2025, according to analysis by cybersecurity firm Bridewell. The number of incidents rose over the period.

The data recorded 26,364 incidents with reporting times and more than 26,000 breaches caused by staff mistakes since 2020.

Human-error breaches increased from 3,847 in 2020 to 5,496 in 2025, a rise of 43%. The figures suggest routine handling errors, rather than malicious attacks, are a major source of data exposure across UK organisations.

Email remained the main cause. Data sent to the wrong recipient accounted for 11,214 incidents between 2020 and 2025, rising from 1,519 in 2020 to 2,459 in 2025, an increase of 62%.

Other common causes included data posted or faxed to the wrong recipient, linked to 4,750 incidents. Failure to redact information appeared in 3,353 cases, while failure to use bcc featured in 2,060. Verbal disclosure of personal data accounted for 1,826 incidents.

Sector impact

The health sector recorded the highest number of human-error breaches, with 5,054 incidents over the period. Education and childcare followed with 4,180, while local government recorded 3,457.

The exposed information included personal identifiers, criminal convictions or offences, health data, and economic and financial data. The mix underlines the sensitivity of the records involved in many of the incidents reported to the regulator.

The reporting data also suggests many organisations are missing the UK GDPR deadline for notifying the ICO of a reportable breach. Of the incidents with a recorded reporting time, 10,077, or 38%, were reported between 24 and 72 hours after discovery, while 6,770, or 26%, were reported in less than 24 hours.

Together, that means 64% were reported within the 72-hour window. But 5,165 incidents, or 20%, took between 72 hours and a week to report, and 4,352, or 17%, took more than a week.

Reporting delays

That leaves more than a third of cases outside the deadline. Under UK GDPR, organisations that notify late must explain the delay to the ICO.

The figures come amid broader concern about how confidently UK organisations handle personal data. Separate government research found that 31% of UK businesses were not confident about storing or transferring personal data securely.

Recent high-profile incidents have also shown how simple handling errors can have serious consequences. In one case, the Ministry of Defence exposed the personal details of nearly 19,000 applicants to the Afghan Relocations and Assistance Policy after a spreadsheet was shared in error.

Chris Linnell, Associate Director of Data Privacy at Bridewell, said: "The scale of these incidents highlights how challenging it is for organisations to support employees in handling personal data safely. Many data breaches do not stem from malicious behaviour, but from simple mistakes in busy working environments."

He said training and internal processes needed attention. "It's important for organisations to ensure employees understand their responsibilities and have the practical skills, clear processes, and the right tools to minimise risk.

"Regular, scenario-based training that reflects day-to-day work is also likely to offer greater value than annual e-training sessions, as it helps employees recognise risks in context and handle personal data with confidence."

Linnell said process design and technical safeguards matter alongside staff awareness. "However, training alone is not enough. Organisations should also simplify and automate processes as much as possible to reduce complexity while maintaining data integrity. Technical controls such as data loss prevention policies, recipient validation checks, encryption, and 'nudge' technologies can provide timely prompts that encourage employees to pause and sense-check their actions before sharing information.

"Finally, a well-tested incident response process and a strong no-blame reporting culture are essential. When employees feel confident they will be supported rather than criticised, organisations are more likely to identify incidents quickly, limit their impact, and learn from them to prevent future occurrences."