Human error continues to expose organisations to data breaches, from emails sent to the wrong recipients to personal information shared accidentally. Bridewell’s analysis of ICO data reveals more than 26,000 human-error-related breaches have been reported since 2020.
Recent research by the Department for Science, Innovation and Technology found that 31% of UK businesses are not confident in storing or transferring personal data securely.
This is demonstrated by new data analysis by cyber security experts at Bridewell, which revealed that over 26,000 data breaches as a result of human error have been reported to the Information Commissioner’s Office (ICO) since 2020.
The Information Commissioner’s Office, the UK regulator for upholding data privacy, has enforcement powers ranging from monetary penalties, enforcement notices, reprimands and even prosecuting individuals and organisations for serious data protection breaches.
Between 2020 and 2025, the top five causes of human-error-related data breaches have been data emailed to the wrong recipient, data posted or faxed to the wrong recipient, failure to redact information, failure to use BCC and the verbal disclosure of personal data. Between 2020 and 2025, human-related breaches rose from 3,847 to 5,496, a 43% increase.
The biggest cause by far is emailing data to the wrong recipient, with 11,214 breaches reported since 2020. These incidents have risen from 1,519 in 2020 to 2,459 in 2025, an increase of 62%.
This is followed by data being incorrectly posted or faxed to the wrong recipient. Between 2020 and 2025, 4,750 incidents of this nature were reported. Failure to redact information was reported in 3,353 incidents, while failure to use BCC was reported in 2,060 incidents. The verbal disclosure of personal data was reported in 1,826 incidents.
The data shows the health industry has the most incidents as a result of human error, with 5,054 reported between 2020 and 2025. The exposed data included personal identifiers, criminal convictions or offences, health data and economic and financial data, highlighting the risk of this sensitive information falling into the wrong hands.
The local government and education and childcare sectors were also responsible for a high number of incidents. Organisations in the education and childcare sector reported 4,180 data security incidents, while the local government sector reported 3,457.
Many damaging data breaches in recent years started with information being shared in error. In one case, an official from the Ministry of Defence inadvertently exposed a spreadsheet with data containing personal details of nearly 19,000 applicants to the Afghan Relocations and Assistance Policy. A Defence Committee report released in July found that the breach stemmed from several failings, including a reliance on inappropriate tools, weak operating procedures, insufficient training and an inadequate culture of data protection.
The data also shows how quickly organisations report these breaches. Of the 26,364 incidents with a recorded reporting time, the largest share (10,077, or 38%) were reported between 24 and 72 hours after discovery, while 6,770 (26%) were reported in less than 24 hours.
This shows that a majority (64%) were reported within 72 hours, the deadline set under UK GDPR for notifying the ICO of a reportable breach. However, more than a third (36%) fell outside this window: 5,165 incidents (20%) took between 72 hours and a week to report and 4,352 (17%) took more than a week.
