Organisations warned to step up as ICO research highlights data breach harm

Organisations are failing to recognise the harm caused by mishandling personal information and have a role to ‘stop the negative ripple effect’, according to the information commissioner.

The assessment came as the ICO released the results of a survey that found that of the 55% of adults who report having had their personal data lost or stolen, 30% report experiencing emotional distress as a result.

Additionally, of those who had experienced a data breach, 25% report that they received ‘no support’ from the organisations responsible, while 32% claim to have found out through the media rather than from the organisation itself.

People in vulnerable situations, including survivors of domestic abuse and those with long-term health conditions, are often disproportionately affected by personal data being mishandled by companies and other organisations, information commissioner John Edwards said in a blog post published alongside the data.

Edwards wrote: “There are two important things I need organisations to understand: empathy and action. You have a role to stop the negative ripple effect in someone’s life from spreading further. It is vitally important to acknowledge what has happened, be human in your response and commit to making sure it doesn’t happen again.”

Qualitative research conducted by the ICO identified people’s experiences of having to move homes, feeling forced out of their jobs and facing discrimination because of data breaches. Participants told the ICO that they felt the impact on their life was insufficiently recognised by the organisation responsible for the data breach.

Edwards said: “We trust organisations with some of the most sensitive personal information imaginable, yet these data breaches continue to happen. This is not just an admin error – it is about people. When data is mishandled, it can have serious and long-lasting consequences, particularly for people in vulnerable situations. We need organisations across the country to do better.” 

The ICO has also published new guidance and resources on communicating with empathy after a data breach.

Savanta conducted the survey on behalf of the ICO, with 5,533 members of the UK public. Fieldwork took place between 11th January and 14th February 2024.