Cyber security firm Bridewell has analysed Information Commissioner's Office (ICO) data and counted more than 26,000 data breaches caused by human error and reported by UK organisations since 2020. Annual human-error breaches rose from 3,847 in 2020 to 5,496 in 2025, an increase of 43%.
Email is the biggest culprit. Data sent to the wrong recipient accounts for 11,214 reported breaches, and the annual count climbed 62%, from 1,519 in 2020 to 2,459 in 2025. Behind it come data posted or faxed to the wrong person (4,750 incidents), failure to redact information (3,353), failure to use bcc (2,060) and verbal disclosure of personal data (1,826).
Health, education and local government lead the count
Health reported the most human-error incidents between 2020 and 2025, at 5,054. Education and childcare followed with 4,180 and local government with 3,457. Bridewell notes the exposed data in the health cases included health records, personal identifiers, criminal convictions or offences, and financial data.
The research points to a recent example of an error escalating. An official at the Ministry of Defence inadvertently exposed a spreadsheet holding personal details of nearly 19,000 applicants to the Afghan Relocations and Assistance Policy. A Defence Committee report published in July put the breach down to several failings, including reliance on inappropriate tools, weak operating procedures, insufficient training and an inadequate data protection culture.
Late reporting is common
Of 26,364 incidents with a recorded reporting time, 64% were reported to the ICO inside the 72-hour UK GDPR deadline: 6,770 (26%) in under 24 hours and 10,077 (38%) between 24 and 72 hours. The remaining 36% missed it, with 5,165 incidents (20%) taking between 72 hours and a week and 4,352 (17%) taking longer than a week. Bridewell says late notifiers must justify the delay to the ICO, and that failing to notify properly can bring fines of up to £8.7 million or 2% of global annual turnover.
Chris Linnell, Associate Director of Data Privacy at Bridewell, said: “Many data breaches often don’t stem from malicious behaviour, but rather from simple mistakes in busy working environments.” He argues that regular, scenario-based training tied to day-to-day work is likely to be worth more than annual e-learning, and that training alone is not enough.
His other recommendations are to simplify and automate processes, and to use technical controls such as data loss prevention policies, recipient validation checks, encryption and “nudge” prompts that make staff pause before sharing information. A well-tested incident response process and a no-blame reporting culture complete the list, so that incidents surface quickly.
The figures come from ICO data security incident trends for 2020 to 2025. Bridewell used them to test whether human-error breaches are rising, which incident types are most common, which sectors report the most and how quickly organisations report.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
