GDPR Breaches Herefordshire Council
Case reference FOI2026/02117
Received 3 September 2026
Published 30 September 2026
Request
I am writing to request information under the Freedom of Information Act 2000 regarding data protection incidents and GDPR breaches within Herefordshire Council.
Please provide the following information covering the last 12 months (from September 2025 to the date of this request):
Total Number of Breaches: The total number of data protection incidents or potential GDPR breaches recorded internally by the council.
ICO Referrals: The number of these recorded breaches that were serious enough to be formally reported to the Information Commissioner’s Office (ICO).
Breach Categories: A high-level breakdown of the causes of these breaches if available (e.g., misdirected emails, lost paperwork, cyber incidents, unauthorised disclosures).
Outcome Actions: The number of incidents that resulted in changes to internal policy, staff disciplinary actions, or data protection retraining.
To ensure this request does not breach Section 40 (Personal Information) of the Freedom of Information Act, I am only seeking high-level, anonymised statistics and figures. I do not require any names, identifying descriptions of individuals, or specific case details.If any part of this request exceeds the cost or time limits set out under
Section 12 of the Act, please prioritize questions 1 and 2, and provide advice and assistance on how I can refine the remainder of the request.I look forward to hearing from you within the statutory 20 working days.Yours faithfully,
Response
I am writing to request information under the Freedom of Information Act 2000 regarding data protection incidents and GDPR breaches within Herefordshire Council.Please provide the following information covering the last 12 months (from September 2025 to the date of this request):
Total Number of Breaches: The total number of data protection incidents or potential GDPR breaches recorded internally by the council.
ICO Referrals: The number of these recorded breaches that were serious enough to be formally reported to the Information Commissioner’s Office (ICO).
Breach Categories: A high-level breakdown of the causes of these breaches if available (e.g., misdirected emails, lost paperwork, cyber incidents, unauthorised disclosures).
Outcome Actions: The number of incidents that resulted in changes to internal policy, staff disciplinary actions, or data protection retraining.
To ensure this request does not breach Section 40 (Personal Information) of the Freedom of Information Act, I am only seeking high-level, anonymised statistics and figures. I do not require any names, identifying descriptions of individuals, or specific case details.If any part of this request exceeds the cost or time limits set out under
Section 12 of the Act, please prioritize questions 1 and 2, and provide advice and assistance on how I can refine the remainder of the request.I look forward to hearing from you within the statutory 20 working days.Yours faithfully,
Answer:
This information is not held in a form that would enable it to be located, retrieved and extracted within the Appropriate Time Limit which equates to 18 hours as defined by the Freedom of Information and Data Protection (Appropriate Limits and Fees) Regulations 2004.
Our electronic reporting systems are unable to run a report for this information. To ascertain the data requested, officers would need to manually check individual files for this information. An initial search has shown that 318 files would need to be checked for this information, and it is estimated that it would take 5 minutes to check each file. Once the details had been identified this would need to be noted and once all files had been checked in this way, the total figures requested could be calculated.
This would at a conservative estimate take at least 26.5 hours to complete. Where the Limit is exceeded Public Authorities are not obliged to supply the information requested by virtue of S12 of the Act. Please take this letter as a refusal notice under S17 of the Act.
However, within the 18 hour limit, we can provide answers for questions 1, 2 and 3 as requested. Please advise us if this is something you require.
Documents
This is Herefordshire Council's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.