UK data breaches: 26,000 incidents caused by human error since 2020

Since 2020, over 26,000 data breaches caused by human error have been reported to the UK Information Commissioner’s Office (ICO). Research indicates that human-related breaches rose by 43 percent between 2020 and 2025, increasing from 3,847 to 5,496 incidents.

The most frequent cause of these breaches is emailing data to the wrong recipient, accounting for 11,214 reported incidents. Other significant causes include incorrect posting or faxing of data, failure to redact information, failure to use bcc, and the verbal disclosure of personal data. The health industry reported the highest number of human-error incidents, with 5,054 cases.

Exposed information includes personal identifiers, criminal convictions, health data, and financial details. While many organizations prioritize digital security measures like encryption and firewalls, physical paperwork remains a significant compliance risk under GDPR. Paper-based failings, such as misfiled or improperly handled documents, often lack the digital audit trails necessary for detection, potentially leading to fines and reputational damage.