Data Breach Incident Report – GDPR Notification

Housing Benefits team member emailed spreadsheet of 143 claimants’ personal data (names, addresses, NI numbers, benefit amounts, sort codes) to wrong external address on 22 Jan 2025. Deletion confirmed; ICO notified within 72hrs; 143 individuals notified within 7 days. ICO not pursuing regulatory action. Lessons: mandatory annual refresher training; bulk email sending policy by April 2025.