The Information Commissioner’s Office has published its Annual Report for 2025/26, revealing a sharp rise in data breaches and complaints.
A total of 200 personal data breaches were reported, up from 152 the previous year, affecting an estimated 31,600 people, compared with 4,918 in 2024/25.
The increase reflects a rise in cyber incidents, which can affect large numbers of people in a single breach.
Data protection complaints more than doubled to 53, up from 25 in 2024/25, with handling of subject access requests the most common issue raised.
Relationships
During the year, the ICO strengthened international relationships, signing agreements with Dubai and Malta and participating in cross-border investigations for the first time.
Information Commissioner Dr Alexandra Delaney-Bhattacharya said: “Data protection is fundamentally about people. Behind every breach is someone whose trust, privacy or safety may be compromised.”
“We are seeing the scale of risk increase — cyber incidents can affect thousands of people at once, alongside new harms such as the misuse of people’s images through AI.”
“A data breach can be life-altering for someone escaping a dangerous relationship. For a child, the misuse of their image can cause lasting harm. These are the realities that make our work so important.”
The report also highlights five regulatory actions taken, including reprimands for Shell Ship Management Ltd, Queen Elizabeth II High School, Payroll Partners Ltd and Manx Care.