FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Data
The ICO received 17,431 personal data breach reports in 2025/26, up 40% on 2024/25, according to its Annual Report 2025/26. It issued eight UK GDPR fines totalling £32.4 million.
Part of: Commercial insurance
In short
The ICO received 17,431 personal data breach reports in 2025/26, a 40% rise on the 12,412 received in 2024/25, according to its Annual Report 2025/26. Sending information to the wrong person by email, post or fax was the commonest incident, at just over 20%, and health, and education and childcare reported the most. 90% of reports closed with informal action. The ICO issued eight UK GDPR penalty notices totalling £32,402,373, including Reddit (£14.5 million) and Capita (£14 million), plus seven reprimands.
These are the latest official UK figures on personal data breaches reported to the Information Commissioner's Office (ICO) and on its enforcement. The main source is the Information Commissioner's Annual Report and Financial Statements 2025/26, covering 1 April 2025 to 31 March 2026 and published in July 2026. Prior year comparisons are from the same report or the ICO Annual Report 2024/25. The figures count breaches reported to the ICO, not every breach that happens.
| Figure | Value | Source and period |
|---|---|---|
| Personal data breach reports received | 17,431 (up 40% from 12,412) | ICO Annual Report, 2025/26 vs 2024/25 |
| Breach reports completed | 12,620 (2024/25: 12,200) | ICO Annual Report, 2025/26 |
| Breach reports open at year end | 6,317 (2024/25: 1,518) | ICO Annual Report, 2025/26 |
| Most common incident type | Personal information sent to the wrong person by email, post or fax: just over 20% of breaches | ICO Annual Report, 2025/26 |
| Highest reporting sectors | Health, and education and childcare | ICO Annual Report, 2025/26 |
| UK GDPR penalty notices | 8, totalling £32,402,373 (2024/25: 2, totalling £3,826,320) | ICO Annual Report, 2025/26 |
| Reprimands | 7 (2024/25: 9) | ICO Annual Report, 2025/26 |
| UK GDPR enforcement notices | 2 (2024/25: 0) | ICO Annual Report, 2025/26 |
| PECR monetary penalties (nuisance calls and messages) | 10, totalling £1,445,000 | ICO Annual Report, 2025/26 |
| Data protection complaints received | 76,743 (2024/25: 42,315) | ICO Annual Report, 2025/26 |
Figures checked 30 October 2026.
The ICO received 17,431 personal data breach reports in 2025/26, which it describes as an increase of 40% on the 12,412 received in 2024/25. In 2023/24 it received 11,680. The ICO completed 12,620 reports in 2025/26, so its open caseload rose from 1,518 to 6,317 by 31 March 2026.
Health, and education and childcare were again the sectors reporting the most breaches. The most common single incident type was sending personal information to the wrong person by email, post or fax, at just over 20% of breaches in 2025/26, up from just over 18% in 2024/25. That is a reminder that many reportable breaches are human error rather than hacking.
The ICO's data security incident trends dashboard breaks reports down by quarter, sector and incident type, including cyber categories such as phishing and ransomware. It was updated on 26 October 2026 with data to Q3 2026 and runs from Q1 2019. The ICO notes that its cyber and non-cyber split is under review and advises caution when comparing categories. We have not reproduced the dashboard's counts here because they are published only in the interactive tool and downloadable dataset.
The 2024/25 annual report gives cyber figures for that year: the ICO triaged 1,746 cyber reports (2023/24: 2,851), completed 15 cyber investigations, managed 61 incidents and issued three cyber reprimands (2023/24: eight). The 2025/26 report does not give a cyber report count in the same form.
Almost all breach reports end without formal action. The ICO's outcome table for breach reports shows:
| Outcome | 2023/24 | 2024/25 | 2025/26 |
|---|---|---|---|
| Informal action, breach recorded, regulatory action criteria not met | 74% | 85% | 90% |
| No further action, breach recorded, criteria not met | 15% | 7% | 2% |
| Investigation pursued | 6% | 3% | 2% |
| No further action, not a personal data breach | 2% | 3% | 2% |
In 2025/26 the ICO concluded 62 UK GDPR investigation cases (2024/25: 43) and 280 incidents (2024/25: 204).
UK GDPR fines rose sharply in 2025/26, from two penalty notices totalling £3,826,320 in 2024/25 to eight totalling £32,402,373. Penalties named in the 2025/26 report include:
| Organisation | Penalty | Reason given by the ICO |
|---|---|---|
| £14,472,500 (February 2026) | No robust age assurance; children's data processed without a lawful basis | |
| Capita plc | £14,000,000 | Cyber attack in April 2023 exposing personal information of over six million people (settlement) |
| 23andMe | £2,310,000 | Security failings following a large-scale cyber attack in 2023 |
| LastPass UK Ltd | £1,228,283 (20 November 2025) | Security failings that let a threat actor extract data on about 1.6 million UK customers |
| MediaLab (Imgur) | £247,590 (February 2026) | Children's personal information not used lawfully |
The report also mentions fines of £18,000 for Birthlink and £66,000 for Police Scotland. The ICO issued seven reprimands and two UK GDPR enforcement notices, to Bristol City Council and South Wales Police. Under PECR it issued 10 monetary penalties totalling £1,445,000 and 10 enforcement notices; in 2024/25 there were nine PECR penalties totalling £890,000. Individual notices are listed on the ICO's enforcement action pages.
A few practical points, which are our reading rather than anything stated by the ICO:
For wider business figures, see our UK cyber breach statistics and the ICO explainer.
How Apex helps: we arrange cyber insurance and professional indemnity insurance for UK firms and can review how the two policies respond to a data breach.
The ICO received 17,431 personal data breach reports in 2025/26 (1 April 2025 to 31 March 2026), up 40% from 12,412 in 2024/25, according to its Annual Report 2025/26. In 2023/24 it received 11,680. These are breaches organisations reported, not every breach that occurred.
According to the ICO Annual Report 2025/26, sending personal information to the wrong person by email, post or fax was the most common incident, at just over 20% of breaches reported in 2025/26. Health, and education and childcare, were the sectors reporting the most breaches.
The ICO issued eight UK GDPR penalty notices totalling £32,402,373 in 2025/26, up from two totalling £3,826,320 in 2024/25. The largest named were Reddit (£14,472,500) and Capita plc (£14,000,000). It also issued 10 PECR penalties totalling £1,445,000 for nuisance marketing.
Rarely. In 2025/26, 90% of breach reports closed with informal action because regulatory action criteria were not met, and an investigation was pursued in 2% of cases, according to the ICO Annual Report 2025/26. The ICO issued seven reprimands and eight UK GDPR fines in the year.
It depends. Many cyber policies cover regulatory fines and penalties only where insurable by law, and the legal position on insuring UK data protection fines is not settled. Costs of responding to an ICO investigation, notifying people and defending claims are more commonly covered. Check the policy wording.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
