NHS Trust apologises over Nottingham attacks' data breach

The medical director of Nottingham University Hospitals NHS Trust has publicly apologised for serious "failures" after staff inappropriately accessed the medical records of the victims of the June 2023 Nottingham attacks. The unauthorised access occurred in 2025, following the sentencing of Valdo Calocane, who killed three people and seriously injured three others.

An inquiry heard that 11 employees have been sacked following initial investigations, including four nurses, one registered professional, and six other staff members. In addition, written warnings were issued to four doctors, five nurses, one registered professional, and two other staff members. None of the professionals voluntarily admitted to accessing the records before discovery.

Medical director Manjeet Shehmar apologised for causing additional distress to the families and admitted the trust initially failed to consider the surviving victims, focusing only on the deceased. The oversight was corrected after a solicitor for two survivors contacted the trust in March 2025. Shehmar also acknowledged that the trust would not have been aware of the data protection complaints without the assistance of the bereaved families, who helped bring the matter to light after learning of related breaches from a healthcare foundation trust.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.