FOI release

GDPR breaches within Herefordshire Council

Case reference FOI2026/02348

Received 30 September 2026

Published 1 October 2026

Request

I am writing to request information under the Freedom of Information Act 2000 regarding data protection incidents and GDPR breaches within Herefordshire Council.Please provide the following information covering the last 12 months (from September 2025 to the date of this request):

1) Total Number of Breaches: The total number of data protection incidents or potential GDPR breaches recorded internally by the council.

2) ICO Referrals: The number of these recorded breaches that were serious enough to be formally reported to the Information Commissioner’s Office (ICO).


3) Breach Categories: A high-level breakdown of the causes of these breaches if available (e.g., misdirected emails, lost paperwork, cyber incidents, unauthorised disclosures).

Response

I am writing to request information under the Freedom of Information Act 2000 regarding data protection incidents and GDPR breaches within Herefordshire Council.Please provide the following information covering the last 12 months (from September 2025 to the date of this request):

1) Total Number of Breaches: The total number of data protection incidents or potential GDPR breaches recorded internally by the council.

Answer: Total number of breaches from 1st September 2025 – 3rd September 2026 (date of request) = 318

2) ICO Referrals: The number of these recorded breaches that were serious enough to be formally reported to the Information Commissioner’s Office (ICO).

Answer: 0.

3) Breach Categories: A high-level breakdown of the causes of these breaches if available (e.g., misdirected emails, lost paperwork, cyber incidents, unauthorised disclosures).

Answers: Breaches are broken down into the following categories:

  • Data quality issue – Incorrect information is recorded on a file such as phone number, wrong house number.

  • Data security issue – Printing/photocopying left on the office printer, forgot to password protect a document before sending, service users reporting post has arrived with the envelope torn or damaged.

  • Email sent to wrong recipient – incorrect person has been sent an email in error. This includes emails sent to members of the public, other professionals and internally to other Herefordshire Council staff.

  • Inappropriate access - Individuals accessing records/files they are not authorised to access.

  • Inappropriate sharing – Wrong attachment added to emails in error, details shared with others that should not be shared for example email address/phone numbers of parent, completed forms sent to professionals when should be blank template.

  • Lost file/equipment/information – Members of staff misplacing mobile phones, notebooks, paperwork.

  • Post sent to wrong address – Documents to incorrect address. This includes situations where Herefordshire Council have not been provided with updated address details from service users or other professionals.

Documents

There are no documents for this release.

This is Herefordshire Council's response to a freedom of information (FOI) or environmental information regulations (EIR) request.

You can browse our other responses or make a new FOI request.