ICO data reveals human error-related personal data breaches soar 43% in five years

New analysis by cybersecurity company Bridwell found that personal data breaches caused by human error rose by 43% over a five-year period, according to figures from the Information Commission (ICO) covering 2020 to 2025. The data demonstrates that simple everyday lapses in awareness and internal security culture remain a major driver of organisational cybersecurity risk.

The analysis identified sending data by email to the wrong recipient as the single most common human error incident, accounting for 11,214 reported occurrences. Other categories included sending information to incorrect recipients by post or fax (4,750 incidents), failing to redact sensitive documents before external transmission (3,353 incidents), omitting blind carbon copy (bcc) in multi-recipient communications (2,060 incidents), and verbally disclosing personal data (1,826 incidents).

Public-facing and data-intensive sectors proved the most vulnerable to these errors. The health sector recorded the highest volume of such data breaches at 5,054 incidents. This was followed by education and childcare with 4,180 incidents, local government with 3,457, the legal profession with 2,495, and the finance, insurance, and credit sector with 2,129 recorded breaches.

On breach reporting response timescales, 38% of incidents (10,077 breaches) were notified between 24 and 72 hours post discovery, while 26% (6,770) were submitted in under 24 hours. A further 20% (5,165) took between 72 hours and one week to report, and 17% (4,352) took longer than a week.

The report also noted that emerging technologies, particularly artificial intelligence (AI), are compounding human vulnerabilities. The National Cyber Security Centre (NCSC) has warned that staff entering sensitive information into consumer AI applications increases exposure to data breaches, intellectual property loss, and regulatory non-compliance, reinforcing the need for enterprise-wide governance, dedicated risk assessments, and targeted workforce training.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.