UK organizations reported 3,600 data breach incidents to the Information Commissioner's Office in the fourth quarter of 2025 alone, a 16% increase over the same quarter a year earlier, according to the ICO's Data Security Incident Trends dataset as analyzed by the Data Protection Network in April 2026. Most of those incidents never become the kind of headline-grabbing case that draws a fine. The bulk are simpler failures, an email sent to the wrong address, a misplaced file, a phishing click, and most close without any further ICO action at all.
How many data breaches are reported to the ICO in the UK?
3,600 is the number of data breach incidents UK organizations reported to the ICO in the fourth quarter of 2025, the most recent quarter covered in the regulator's published dataset. That figure comes from the ICO's own Data Security Incident Trends dataset, which tracks every report received from organizations required to notify the regulator under UK GDPR, and was analyzed by the Data Protection Network in an April 2026 write-up.
Figure 1: UK organizations reported 3,600 data breach incidents to the ICO in the fourth quarter of 2025. Source: Information Commissioner's Office, Data Security Incident Trends, as summarized by the Data Protection Network (April 2026).
That total represents a 16% increase compared with the same quarter of 2024, continuing a trend of rising report volumes even as the ICO's enforcement caseload has fallen elsewhere; our breakdown of 2025's 31 ICO enforcement actions shows the case count itself dropping even as reported incidents climb. Quarterly totals do not distinguish between minor administrative slips and serious cyberattacks, which is why the split between the two matters more than the headline number on its own.
What causes most UK data breach reports?
Non-cyber failures cause the large majority of incidents the ICO logs. In the fourth quarter of 2025, 77% of reported incidents were non-cyber, meaning they had no clear online or technical element, while the remaining 23% involved phishing, ransomware, or another attack with a digital vector, per the same ICO dataset.
Figure 2: More than three-quarters of ICO-reported incidents in the fourth quarter of 2025 were non-cyber. Source: Information Commissioner's Office, Data Security Incident Trends, as summarized by the Data Protection Network (April 2026).
Within that non-cyber majority, the ICO's own incident categories rank personal data emailed to the wrong recipient as the single most common cause, ahead of unauthorized access to personal data, phishing, and failure to redact personal data before disclosure. The regulator's public dataset publishes this list by rank rather than by an exact percentage share for each cause, so the order, not a precise breakdown, is the reliable takeaway here.
A current privacy policy will not stop an employee from emailing the wrong recipient, but it is part of the documented data-handling practice the ICO checks once a breach report lands on its desk. A privacy policy generator built around current UK GDPR requirements keeps that disclosure current without waiting for an incident to force the update. Whichever category a report falls into, the ICO's decision on whether to investigate further depends less on the cause and more on how many people were affected and how quickly the incident was reported.
Does the ICO investigate every reported breach?
No. The ICO closes 70% of reported incidents with no further regulatory action once it has reviewed the report, reserving investigation and potential enforcement for cases involving large volumes of people, special category data, or vulnerable data subjects, according to the same Data Protection Network analysis of ICO figures.
Figure 3: Seven in ten reported incidents close with no further ICO action. Source: Information Commissioner's Office, Data Security Incident Trends, as summarized by the Data Protection Network (April 2026).
Scale plays a large part in that filtering. Just over 50% of breaches reported across 2025 affected only 1 to 9 individuals, well below the threshold that tends to draw a closer look, while reports affecting thousands of people or special category data attract scrutiny regardless of cause. A single misdirected email to one person and a ransomware attack touching tens of thousands of records both start as one report in the same dataset, but they do not end the same way.
How quickly do UK organizations report a breach to the ICO?
UK GDPR requires organizations to report a qualifying breach to the ICO within 72 hours of becoming aware of it. 37% of organizations missed that window across 2025: 18% reported up to a week late and 19% reported more than a week late, according to the same Data Protection Network analysis of ICO figures.
Figure 4: More than a third of organizations missed the 72-hour ICO reporting deadline in 2025. Source: Information Commissioner's Office, Data Security Incident Trends, as summarized by the Data Protection Network (April 2026).
A late report does not automatically trigger a fine, but it removes one of the strongest arguments an organization has if the ICO does decide to look closer: that it acted promptly once it knew something had gone wrong.
How does ICO breach data compare to the UK's overall cyber attack rate?
The ICO's incident dataset only captures breaches organizations formally report as involving personal data. The wider picture is larger: 43% of UK businesses, roughly 612,000 organizations, identified a cyber security breach or attack of any kind in the past 12 months, according to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey, published April 30, 2026, holding steady after falling from 50% the year before.
Figure 5: Larger UK organizations report breaches and attacks far more often than micro businesses. Source: UK Department for Science, Innovation and Technology, Cyber Security Breaches Survey (April 2026).
That gap widens sharply with organization size: 42% of micro businesses identified a breach or attack, compared with 46% of small businesses, 65% of medium businesses, and 69% of large businesses. Phishing remained the most common attack type by far, affecting 38% of businesses and 25% of charities. For the global cost and cause picture behind incidents like these once they escalate into a confirmed breach, see our worldwide data breach figures for 2026, which cover IBM, Verizon, and Identity Theft Resource Center research across the same period.
UK data breach and cyber attack figures at a glance
| Metric | Figure | Period | Source |
|---|---|---|---|
| ICO data breach reports | 3,600 | Q4 2025 | ICO / Data Protection Network |
| Year-over-year change | +16% | Q4 2025 vs Q4 2024 | ICO / Data Protection Network |
| Non-cyber incidents | 77% | Q4 2025 | ICO / Data Protection Network |
| Closed with no further ICO action | 70% | 2025 | ICO / Data Protection Network |
| UK businesses breached or attacked | 43% | 12 months to early 2026 | DSIT Cyber Security Breaches Survey |
| Large UK businesses breached or attacked | 69% | 12 months to early 2026 | DSIT Cyber Security Breaches Survey |
Source: Information Commissioner's Office, Data Security Incident Trends, as summarized by the Data Protection Network (April 2026); UK Department for Science, Innovation and Technology, Cyber Security Breaches Survey (April 2026).
The Bottom Line
3,600 reports in a single quarter, a 16% year-over-year rise, and a 70% no-further-action rate together describe a system built around volume rather than drama. Most of what the ICO logs is a misdirected email or a similar procedural slip involving a handful of people, not a mega-breach, and most of it closes without a fine or a press release. What separates a quiet closure from an investigation is scale, the sensitivity of the data involved, and whether the 72-hour reporting deadline was met. An organization that keeps its data-handling documentation current and reports promptly when something does go wrong is following the exact pattern the ICO's own numbers reward.
Frequently Asked Questions
How many data breaches were reported to the ICO in the UK? 3,600 incidents in the fourth quarter of 2025 alone, a 16% increase year over year, according to the Information Commissioner's Office's Data Security Incident Trends dataset as summarized by the Data Protection Network in April 2026.
What percentage of UK data breaches reported to the ICO are non-cyber? 77% of incidents reported to the ICO in the fourth quarter of 2025 were non-cyber, meaning they had no clear online or technical element, such as personal data emailed to the wrong recipient. The remaining 23% involved phishing, ransomware, or another online attack vector.
Does the ICO investigate every reported data breach? No. The ICO closes 70% of reported incidents with no further regulatory action, reserving investigation for cases involving large numbers of affected people, special category data, or reports filed well past the 72-hour deadline.
How does ICO breach data compare to the UK's overall cyber attack rate? 43% of UK businesses, roughly 612,000 organizations, identified a cyber security breach or attack in the past 12 months, according to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey published in April 2026, though only a fraction of those incidents involve personal data serious enough to require an ICO report.
Where the Numbers Come From
- Information Commissioner's Office. "Data Security Incident Trends." Dataset updated through Q4 2025, the primary source for report volumes and incident category rankings cited in this post.
- Data Protection Network. (2026). "What Data Breach Trends Tell Us." Analysis by Simon Blanchard, published April 2026, summarizing the ICO's Q4 2025 Data Security Incident Trends figures, including the 3,600 report total, the 16% year-over-year increase, the 77/23 non-cyber/cyber split, the 70% no-further-action rate, and the 72-hour reporting timeliness breakdown.
- UK Department for Science, Innovation and Technology. (2026). "Cyber Security Breaches Survey 2025/2026." Published April 30, 2026, covering breach and attack prevalence across UK businesses and charities by size.
Note: All figures verified as of October 2026. The ICO refreshes its Data Security Incident Trends dataset each quarter, and the Cyber Security Breaches Survey is published annually by DSIT; expect this post's figures to update at least twice a year as new quarters and survey editions are released.
