Data Breach Claims UK discusses a surge in police data breaches highlighting how both human error and cyber threats have increasingly exposed sensitive personal information held by UK law enforcement.

Cyberattacks and human error

Data breaches can occur within the police through cyberattacks as well as human error and UK police forces have experienced a number of security incidents since 2022.

Figures obtained by Data Breach Claims UK found that, in the past three years, over 13,000 data breach incidents have taken place within UK police forces.

Police officers and staff have access to vast amounts of personal data, which can include information such as a person’s name, phone number, email or address.

As police forces have to keep extensive records for investigations, they are seen as data controllers under the Data Protection Act 2018.

As a result, breach incidents can occur where this personal data is destroyed, altered or lost either accidentally or unlawfully, which can lead to a victim experiencing financial loss or psychological harm.

Security incidents

According to a study conducted by VPNoverview in 2020, UK police forces suffered more than 2,000 data breaches across the year, highlighting both the threat from ransomware used by cyber criminals as well as malicious insiders who may be working for the police.

In 2022/23, forces saw 2,711 data breaches take place before this number rose to 4,643 a year later.

Over the past year, the force has seen another increase in these security incidents, with the total standing at 4,759.

Due to the sensitive nature of the information held, police forces try and ensure that this data is handled with the utmost respect to maintain the public’s trust and confidence.

However, data breaches within the force are a significant and growing concern as they can happen in many different ways.

“Internal mishandling”

Bethan Simons, Solicitor, JF Law said: “Breaches don’t always have to be complex cyberattacks, as breaches can often occur from human error.

“This can include misdirected emails, documents sent to the wrong address, the loss or theft of devices such as laptops or USB sticks containing sensitive information or even the accidental publication of data, as seen with several UK forces.

“Internal mishandling is another cause of data breaches, such as officers accessing data without authorisation or failing to redact certain sensitive details.

“To prevent these breaches, forces must prioritise data protection measures involving comprehensive training for staff on data handling protocols, encryption of devices and strict policies regarding the sharing and retention of data.”

Police services across the UK with the most data breaches

Via freedom of information requests, Data Breach Claims UK also found out which police forces have recorded the most data breaches.

The Metropolitan Police Service logged the highest number of breaches, totalling 2,271 incidents, followed by Police Scotland, who recorded 1,398 breaches.

In 2024, the Information Commissioner’s Office (ICO) reprimanded West Midlands Police after they had incorrectly merged the records of two victims of crimes however, one was also a suspect and this was seen as a breach of the Data Protection Act 2018.

Mistakes like this within the police can lead to inaccurate personal information being processed, ongoing investigations being affected, and data breach victims having their sensitive data leaked.

As a consequence of the data breaches forces have suffered since 2022, 291 claims have been lodged against the police looking for compensation.

This has led to a total of £501,370 being paid out to successful claimants, with the highest amount being paid in 2022/23, at £236,270.