Paper records in UK data breach reports: the ICO’s figures, 2019 to 2025

The ICO’s caveats, in plain words

How to read these figures

• The ICO is reviewing how it splits cyber from non-cyber. Its page says the way it categorises incidents as cyber or non-cyber in the dashboard is currently under review, and that caution should be taken in drawing conclusions from that split. All three paper types sit in the non-cyber category, and this page uses the split for one sentence only, to say so.
• Categories, incident types and sectors are a best fit. The ICO allocates them. Where several factors contributed, the most significant one is assigned. So a breach that involved paper and something else may be recorded under the something else, and the sector is the ICO’s judgement of the organisation.
• The ICO warns against reading change over time too closely. Its page says the way it inputs data changes over time, which causes discrepancies, and that caution should be taken in drawing conclusions on changes in specific sectors, incident types or outcomes. The fall in the paper share on this page is in the file; how much of it is recording is not knowable from the file.
• Three incident types, and only three. A paper breach report here is one recorded as “Loss/theft of paperwork or data left in insecure location”, “Data posted or faxed to incorrect recipient” or “Incorrect disposal of paperwork”, the ICO’s own names. “Failure to redact” can be a paper document or a file and “Verbal disclosure of personal data” is neither, so neither is counted. Nothing in the file names a visitor book, a sign in sheet or a reception desk.
• One count per report. The file has one row for each report and each type of personal data in it, 206,140 rows for 77,221 reports. The ICO’s page says that some reports hold multiple characteristics and appear on multiple rows, which may make it appear as if there are more breaches than is actually the case. Every count on this page is of distinct report references.
• Only breaches that were discovered and reported. The ICO says the data should not be seen as a definitive source for that reason, and that some cases, which may include some of the larger and more serious breaches, are transferred to a separate system and are not in this data.
• Two of the ICO’s own definitions changed. Its page says the definitions of “informal action taken” and “no further action” changed in April 2021, so there are far more cases recorded as informal action since then, and that in late 2019 it moved away from recording cases as “general business”. It also notes a substantial drop in reporting in the second quarter of 2020, which it attributes to the first national lockdown.
• Calendar quarters, and a first quarter the page does not describe. The ICO says the data is presented in calendar years and quarters, and that it starts at the second quarter of 2019 because incidents were recorded differently before. The file it publishes carries rows for the first quarter of 2019 as well, 3,372 of them, and they are counted here as the file holds them.
• Numbers of people affected are ranges, and reporting times may be off by a day. The ICO publishes ranges to guard against spurious accuracy. It records midnight where an organisation gives a date but no time of discovery, so some reports look as if they came in after 72 hours when they did not. The figures are from the initial report, a point in time, not the outcome.