Your Force Has Had
A Data Breach
What a force must do and tell you after a data breach or cyber incident, the practical steps that protect your accounts and your household, your rights to information and to complain, how compensation works in general, and where to get support. Calm, sourced and written for officers and staff.
Independent information, not advice · Sources checked 1 October 2026 · England and Wales unless stated
Follow your force's official updates, not messages that claim to be about the breach. Change any reused passwords, turn on two-step verification and report phishing. Your force must tell you without undue delay if the breach is likely to put you at high risk. If your name, role or address may be exposed, speak to your force's security lead. Distress is recognised in law, and support is available.
Finding out that your details may be in someone else's hands is unsettling, and it is normal to feel anxious, angry or on edge. Most breaches do not lead to harm, and there are clear steps that reduce the risk. This page sets out what the law and official guidance say, as checked on 1 October 2026. It does not tell you what to decide about your own case, and it does not comment on any live investigation beyond what the force concerned has said.
If you are here because of the Dyfed-Powys Police cyber incident: on 25 September 2026 the force said an incident identified on 14 September disrupted some non-emergency systems, that it had found no evidence that members of the public's personal data had been accessed or compromised, and that it was continuing to investigate whether staff information may have been accessed or compromised. It said it had notified the ICO and would provide appropriate advice to colleagues if required. Our summary, with the date we checked, is on the Dyfed-Powys Police page. The force's own statement and internal updates are the authority.
The first 48 hours: a calm checklist
These steps come from the National Cyber Security Centre (NCSC) and the ICO's guidance for people affected by a breach. None of them needs you to know yet whether your own data was taken.
- Get your information from official channels. The NCSC says to find out whether you are affected through the organisation's official website or channels, and not to use links or contact details in messages you have been sent. For your own force, that means intranet notices, line management briefings and the force's published statements.
- Expect scam messages, possibly weeks later. The NCSC warns that criminals exploit high-profile breaches, even against people whose data was not taken, and lists lures such as "resetting passwords", "receiving compensation" and "scanning devices", and pressure to act quickly.
- Fix reused passwords. If a password you still use appears in a message, the NCSC says to change it as soon as you can, and to change it on any other account that uses the same one. Use two-step verification where available; the ICO also recommends strong passwords and multi-factor authentication.
- Check your accounts and money. Look for log-in failures, changed security settings and sign-ins you do not recognise (NCSC). The ICO suggests checking bank statements and getting a copy of your credit report.
- Report work-related concerns at work. Anything about force systems, warrant cards, work devices or a work email should go through your force's own reporting route, so the people investigating see it.
- If your safety is a worry, say so early. Tell your line manager or your force's security or professional standards lead. See personal security below.
- Talk to someone. Your Federation, union or staff association rep, your force's wellbeing services, or one of the confidential services above.
What counts as a data breach, and which law applies to staff data
UK GDPR Article 4(12) defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It covers cyber attacks, but also mistakes such as an email to the wrong person or a spreadsheet published by error. A cyber incident is not automatically a personal data breach: that depends on whether personal data was affected.
Police forces work under two data protection regimes. Part 3 of the Data Protection Act 2018 applies to processing for "the law enforcement purposes", which section 31 defines as the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against threats to public security. The ICO's guide says processing by a police force that is not for the primary purpose of law enforcement is covered by the UK GDPR, and gives internal HR as an example. In its penalty notice against the Police Service of Northern Ireland, the ICO applied the UK GDPR to the force's processing of officer and staff data.
| Data | Usual regime | Breach rules |
|---|---|---|
| Your HR, pay, pension, vetting-file and contact details as an employee or officer | UK GDPR with Part 2 of the DPA 2018 (ICO: HR is not law enforcement processing) | Articles 33 and 34 |
| Case files, intelligence and records about victims, witnesses and suspects | Part 3 of the DPA 2018 (law enforcement purposes) | Sections 67 and 68 |
| Your name appearing in an operational record, such as a statement you wrote | Depends on the primary purpose of that processing; ask the force's data protection officer | Either set, depending on the regime |
The two sets of breach rules are close to identical, so for most readers the difference matters less than it sounds. The main exception is noted in the next section.
What your force must do, and what it must tell you
Your force (as controller) has three separate duties after a personal data breach. A supplier that suffers a breach (a processor) must tell the force without undue delay (UK GDPR Article 33(2); DPA 2018 section 67(9)).
| Duty | When it applies | Deadline | What it must include |
|---|---|---|---|
| Record the breach | Every personal data breach, reportable or not | No fixed deadline | The facts, its effects and the remedial action taken (Article 33(5); s67(6)) |
| Notify the regulator | Unless the breach is unlikely to result in a risk to people's rights and freedoms | Without undue delay and, where feasible, within 72 hours of becoming aware; reasons if later; can be given in phases | Nature of the breach, categories and approximate numbers of people and records, data protection officer contact, likely consequences, measures taken (Article 33(3); s67(4)) |
| Tell the people affected | Where the breach is likely to result in a high risk to their rights and freedoms | Without undue delay | In clear and plain language: what happened, a contact point, likely consequences and the measures taken or proposed (Article 34(2); s68(2)) |
When a force does not have to tell individuals directly. Article 34(3) and section 68(3) set three exceptions:
- the data was protected so that it is unintelligible to anyone not authorised to see it, for example encrypted;
- the force has since taken measures that mean the high risk is no longer likely to materialise; or
- it would involve disproportionate effort, in which case people must be informed in another equally effective way, such as a public communication.
The regulator can require the controller to tell people, or decide that an exception applies (Article 34(4); s68(6)). For law enforcement data only, section 68(7) also lets a force restrict what it tells people, for as long as necessary and proportionate, to avoid obstructing an inquiry or investigation, prejudicing the prevention or detection of crime, or to protect public security or others' rights. The UK GDPR has its own exemptions elsewhere in the 2018 Act, which we have not analysed here.
The ICO's breach guidance for organisations says that when telling individuals, an organisation should give specific and clear advice on the steps they can take to protect themselves. If your force's message does not tell you what was affected and what to do, it is reasonable to ask its data protection officer.
In practice, the first public statement after a cyber incident often says the investigation is ongoing and that the force is still establishing what, if anything, was taken. That is consistent with the law: the duty to tell individuals arises once a high risk is likely, and information can follow in phases.
The regulator: the ICO became the Information Commission on 30 September 2026
Under the Data (Use and Access) Act 2025, the Information Commissioner's Office was replaced on 30 September 2026 by the Information Commission, a body led by a board rather than a single commissioner. GOV.UK's announcement says the transition does not change the regulator's role, responsibilities or powers for individuals and organisations, and the ICO says it is still referred to as the ICO. Legislation on legislation.gov.uk now refers to "the Commission". Force statements issued before that date, such as Dyfed-Powys Police's of 25 September 2026, refer to the ICO; it is the same regulator.
The regulator investigates complaints and can take enforcement action such as reprimands, enforcement notices and fines. It does not award compensation to individuals.
Protect your accounts and spot follow-up scams
- Change any password you still use if it appears in a suspicious message, and change it on every other account that uses the same one.
- Turn on two-step verification, or use a passkey where offered.
- Look for failed log-ins, changed security settings and messages sent from your account that you do not recognise.
- The NCSC mentions tools such as haveibeenpwned.com for checking whether your details appear in other public breaches.
- Check bank statements and get a copy of your credit report; look for activity you do not recognise.
- Report lost or stolen documents, such as a passport or driving licence, to the body that issued them.
- The ICO notes that Cifas, the UK fraud prevention service, offers protective registration, which flags your details on its National Fraud Database. We have not checked its current terms.
Reporting suspicious messages (NCSC).
| What you received | What the NCSC says to do |
|---|---|
| Suspicious email to a personal account | Forward it to report@phishing.gov.uk |
| Suspicious text | Forward it to 7726 (free) |
| Suspicious call | Hang up and contact your phone provider |
| You have lost money | Tell your bank and report it to Report Fraud (in Scotland, call 101) |
| Anything to a work account or device | Not an NCSC rule: use your force's own reporting route too, so its investigators see it |
A message that knows your name, rank, collar number or station can feel genuine. The NCSC's point is that breach-themed scams are designed to feel personal. Check through a channel you already trust, such as the number on your force's intranet or a phone call to someone you know.
Personal security if your name, role or address may be exposed
For police officers and staff, the worry after a breach is often not fraud but being identified. The force is responsible for assessing the risk to its people, and it has information you do not. The right first step is to tell your line manager or the force's security, counter-corruption or professional standards lead what worries you, especially if you work in a sensitive role, have an unusual name, or have had threats before.
We have not found a national, published scheme for officers whose data is exposed in a breach, so we do not name one. What a force offers is decided locally. As an example only, PSNI's statement published with the ICO's October 2024 announcement said it had given crime prevention advice to officers, staff and their families through online tools, advice clinics and home visits.
GOV.UK says the open register is the version anyone can buy, and that opting out does not affect your right to vote. You can opt out through your electoral registration office.
If your safety, or that of someone in your household, would be at risk, the Electoral Commission says you can register anonymously, supported by a court document or an attestation. People who can attest include a police officer of inspector rank or above. It lasts a year and must be renewed.
Review what you and your family share publicly: photos showing your home, your car registration, your shifts or your workplace. The NCSC also notes that information posted online helps scammers make phishing more convincing.
See keeping your address private and social media and off-duty conduct.
Call 999. A data breach does not change the normal emergency route, and telling the force about a specific threat is how it can act on it.
Your rights: information, access and complaints
You have the same data protection rights as anyone else whose data your force holds. The complaint route changed in 2026, so older guidance may be out of date.
| Route | What it gets you | The rule |
|---|---|---|
| Ask the data protection officer | Answers about what was affected and what is being done | Public authorities must designate a DPO (UK GDPR Article 37(1)(a)); you may contact the DPO about all issues relating to your data (Article 38(4)) |
| Subject access request | Confirmation of what the force holds about you, a copy, and who it has been disclosed to | UK GDPR Article 15; the ICO says organisations usually have one month to respond |
| Complaint to your force | A formal response to your concern about how your data was handled | DPA 2018 section 164A (fully in force 19 June 2026): the force must make complaints easy, acknowledge yours within 30 days and tell you the outcome without undue delay |
| Complaint to the regulator | An independent look at whether the law was followed | DPA 2018 section 165 (UK GDPR Article 77 was omitted on 19 June 2026); the ICO recommends giving the organisation a chance first but says you can complain at any time |
| Court | Compensation, or an order requiring compliance | UK GDPR Article 82; DPA 2018 sections 167 to 169. See compensation |
The ICO's page on complaining to an organisation (updated 29 June 2026) says the guidance is under review because of the Data (Use and Access) Act, so check it again before relying on detail.
Compensation: how it works in general
This section explains the legal framework neutrally. It is not a view on whether any particular breach gives anyone a claim, and we do not recommend any solicitor or claims business.
- The right. UK GDPR Article 82 gives anyone who has suffered material or non-material damage as a result of an infringement a right to compensation from the controller or processor. Section 168 of the Data Protection Act 2018 says non-material damage includes distress. For law enforcement processing, section 169 gives an equivalent right and says damage includes financial loss and distress.
- It depends on an infringement and on damage. A controller is exempt if it proves it was not in any way responsible for the event giving rise to the damage (Article 82(3); s169(3)). Being in a breach is not, on its own, proof of either.
- The regulator does not pay out. The ICO says it cannot award compensation or advise on claims, and that you do not have to complain to it first or wait for its outcome to go to court. Regulatory fines are separate from compensation.
- Routes. The ICO says you can ask the organisation directly; if it does not agree, a court decides. It strongly recommends independent legal advice about the strength of a case before going to court. Section 168 also allows claims brought by a representative body for someone.
- Time limits. We could not confirm from a primary source which limitation period applies to data protection compensation claims. The Limitation Act 1980 sets six years for actions founded on tort (section 2) and for sums recoverable by statute (section 9), and a special, usually shorter, regime where the damages claimed include personal injury (section 11). Get advice early rather than rely on any one figure.
- Federation, union and staff association support. These bodies provide representation and, in some cases, legal assistance to members under their own rules. We do not say what any of them has advised about a specific incident unless we have read it in their own published statement.
The NCSC lists messages about "receiving compensation" among the lures criminals use after a breach. A genuine offer from your force or your representative body can be checked through an official channel you already use.
Past police incidents with official outcomes
Only incidents where we read an official source are listed, with the source's date. Press coverage of other incidents is not repeated.
| Incident | What the official source says | Outcome (as published) |
|---|---|---|
| Police Service of Northern Ireland, 8 August 2023 | ICO: hidden data on a spreadsheet released in response to a Freedom of Information request revealed the surnames, initials, ranks and roles of all 9,483 officers and staff, leaving many fearing for their safety. | ICO fine of £750,000 (announced 3 October 2024), under the UK GDPR; £5.6 million without the public sector approach. The NI Policing Board said on 17 December 2025 that the Executive approved £119 million to settle claims. The Police Federation for Northern Ireland reported in February 2026 a £7,500 universal offer, with exceptional cases free to continue legal action. |
| Metropolitan Police Service, August 2023 | Mayor of London's answer (17 October 2023): the Met raised the incident with the ICO and the National Crime Agency, was in contact with the NCSC, and a review of all contracts and suppliers with access to employee personal data was under way. | We did not find a published ICO outcome for this incident. We could not read the Met's own original statement, so we do not repeat press descriptions of the data involved. |
| Suffolk Constabulary | ICO: sensitive personal data was inadvertently disclosed in Excel spreadsheets in response to Freedom of Information requests. The summary we read does not say whose data it was. | ICO reprimand, 20 May 2026 |
| Dyfed-Powys Police, 14 September 2026 | Force statement (25 September 2026): cyber incident disrupting some non-emergency systems; no evidence of public data being accessed; investigation into whether staff information was affected; ICO notified; Tarian managing the investigation. | Ongoing at 1 October 2026. See the dated summary |
Two of these involved spreadsheets released under Freedom of Information rather than a cyber attack: a breach does not need a hacker. Outcomes depend on the facts of each case, so none of these predicts what will happen in another.
Looking after yourself and your colleagues
The law recognises distress as real damage (DPA 2018 section 168). Feeling unsettled is a normal reaction, not a weakness, and it usually eases as facts become clear. Some practical points:
- Limit the doom-scrolling: check the official update at set times rather than following every rumour.
- Tell your household what to watch for, calmly, so they are not caught out by a scam call.
- Use what your force offers, such as its employee assistance programme or occupational health, and ask your rep what support is available locally.
- If sleep, mood or concentration are affected for more than a short while, speak to your GP. Help works, and confidential services are listed on this page.
- If a colleague seems especially affected, see supporting a colleague who is struggling.
Stress-related absence is handled like any other sickness absence. Our free police sick pay calculator shows how full and half pay would work out for officers, and stress leave explained covers the process. For every confidential service and what it does, see the support services directory.
Questions to ask
- Was my personal data affected, and which categories (contact details, address, role, vetting, bank, health)?
- Was it held by the force or by a supplier?
- Has the breach been reported to the regulator, and when?
- What are you doing to reduce the risk, and what do you advise me to do?
- Who do I contact if I have a security concern about my home or family?
- How do I make a complaint under section 164A, and who handles it?
- What support is available to members affected by this incident?
- Is legal assistance available under the scheme rules, and on what conditions?
- Has the body published anything about this incident?
- Should I keep a record of time, costs or effects, and in what form?
- Who should I speak to if I am worried about my safety at home?
A short written log of what you were told, when, and any costs or effects is useful whatever you later decide, and helps your rep help you.
What people get wrong
- "A cyber attack means my data was stolen." Not necessarily. A breach of personal data is a specific thing; many incidents disrupt systems without taking personal data. Wait for what the force confirms.
- "The force has to email everyone straight away." The duty to tell individuals applies where a high risk is likely, without undue delay, and has exceptions. Recording, and usually reporting to the regulator, is wider.
- "The ICO will get me compensation." It cannot. Compensation is agreed with the organisation or decided by a court.
- "Being in a breach means an automatic payout." The law requires an infringement and damage, and a controller can show it was not responsible. The PSNI universal offer followed a specific error, a £119 million funding decision and group legal action.
- "A message that knows my rank and station must be genuine." The NCSC warns breach-themed scams are built to feel personal. Check through a channel you already trust.
- "Opting out of the open register stops me voting." GOV.UK says it does not.
- "The ICO no longer exists." Its legal form changed on 30 September 2026; it is still referred to as the ICO and its role is unchanged.
What we could not verify
- Limitation period for data protection claims. We found no primary source that settles which period applies; we give the Limitation Act's general rules and suggest early legal advice.
- UK GDPR exemptions that could delay telling staff. Part 3 has an express restriction (section 68(7)); the UK GDPR exemptions in the 2018 Act are complex and not analysed here.
- A national support scheme for exposed officers. We found none published, so support is described as a force decision.
- The Met's 2023 incident. We could not read the Met's own original statement; we relied on the Mayor of London's answer.
- The Dyfed-Powys investigation. Whether any staff information was accessed is not known from official sources as at 1 October 2026.
- Updated ICO guidance. Several ICO pages say they are under review after the Data (Use and Access) Act 2025. We used the legislation text where guidance may lag.
- Cifas protective registration terms and cost. Mentioned because the ICO mentions it; we did not read Cifas's current terms.
- Scotland and Northern Ireland. Data protection law is UK-wide, but support routes, electoral registration and court procedures differ.
Frequently Asked Questions
What should I do if my police force has a data breach?
Rely on your force's official updates, not on messages that claim to be about the breach. Change any password you reuse elsewhere, turn on two-step verification, and watch for phishing, which the NCSC says often follows high-profile breaches. If your name, role or address may be exposed, speak to your force's security or professional standards lead. Ask your Federation, union or staff association for support.
Does my force have to tell me if my data was in a breach?
Only in some cases. Under UK GDPR Article 34 (and section 68 of the Data Protection Act 2018 for law enforcement data) the controller must tell you without undue delay if the breach is likely to result in a high risk to your rights and freedoms, subject to limited exceptions. Lower-risk breaches must still be recorded, and reported to the regulator unless unlikely to result in any risk.
How long does a police force have to report a data breach to the ICO?
Without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms (UK GDPR Article 33; section 67 of the Data Protection Act 2018 for law enforcement processing). A late report must give reasons for the delay, and information can be provided in phases.
Which data protection law covers police officers' and staff HR data?
Usually the UK GDPR. The ICO says processing by a police force that is not for the primary purpose of law enforcement, such as internal HR, falls under the general regime (UK GDPR with Part 2 of the Data Protection Act 2018). Part 3 of the Act covers processing for law enforcement purposes, such as investigations and prosecutions. The ICO's PSNI penalty notice applied the UK GDPR to officer and staff data.
Can I claim compensation for a police data breach?
The law gives a right to compensation for material or non-material damage caused by an infringement (UK GDPR Article 82; section 169 of the Data Protection Act 2018), and distress counts. A breach alone does not decide whether the law was infringed or what damage was caused. The ICO says you can ask the organisation directly, that a court decides disputed claims, and that it cannot award compensation itself.
Does the ICO award compensation for data breaches?
No. The ICO says it cannot award compensation or advise on making a claim, even where it finds an organisation broke data protection law. It can investigate complaints and take enforcement action, such as reprimands and fines, which are paid to the regulator, not to the people affected. Compensation is agreed with the organisation or decided by a court.
How long do I have to make a data breach compensation claim?
We could not confirm a single time limit for data protection claims from a primary source. The Limitation Act 1980 gives six years for actions founded on tort and for sums recoverable by statute, and generally three years where the damages claimed include personal injury. Which applies depends on how a claim is framed, so take independent legal advice early.
How do I complain to my force about how it handled my data?
Since 19 June 2026 section 164A of the Data Protection Act 2018 gives you a right to complain to the controller, which must make complaints easy (for example an electronic form), acknowledge yours within 30 days and tell you the outcome without undue delay. Your force must also have a data protection officer you can contact (UK GDPR Articles 37 and 38). You can complain to the regulator at any time.
Is the ICO still called the ICO?
Mostly. On 30 September 2026 the Information Commissioner's Office was replaced by a board-led body, the Information Commission, under the Data (Use and Access) Act 2025. The ICO says it is still referred to as the ICO, and GOV.UK says the change does not alter the regulator's role, responsibilities or powers for individuals and organisations.
What should I do if my home address or role may have been exposed?
Tell your force's security or professional standards lead, or your line manager, so the force can assess the risk to you and your household; that assessment is the force's job. Practical steps include opting out of the open electoral register, which does not affect your right to vote. Anonymous registration is possible where your safety is at risk, with an attestation from, among others, a police officer of inspector rank or above.
How do I report a phishing email after a police data breach?
The NCSC says to forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726, to hang up on suspicious calls and contact your phone provider, and, if you have lost money, to tell your bank and report it to Report Fraud. For anything sent to a work account, follow your force's own reporting route as well.
What happened in the PSNI data breach?
On 8 August 2023 the Police Service of Northern Ireland released a spreadsheet in response to a Freedom of Information request; hidden data in it revealed the surnames, initials, ranks and roles of all 9,483 officers and staff. The ICO fined PSNI £750,000 in October 2024, saying the fine would have been £5.6 million without its public sector approach. In February 2026 the Police Federation for Northern Ireland reported a £7,500 universal compensation offer.
Has Dyfed-Powys Police had a data breach?
Dyfed-Powys Police said on 25 September 2026 that a cyber incident identified on 14 September disrupted some non-emergency systems, that it had found no evidence that the public's personal data was accessed, and that it was still investigating whether staff information may have been affected. It had notified the ICO. That was its latest statement when we checked on 1 October 2026.
Sources and how we checked them
Every factual claim on this page was written from the sources below, read on 1 October 2026. Rules and figures change, so check the source for the date you are reading this. Where we could not confirm something from an official or independent source, the page says so rather than guessing. Spotted something out of date? See our corrections policy.
- UK GDPR, Articles 4(12), 33 and 34 (legislation.gov.uk, revised text as at 30 September 2026) — definition of a personal data breach; 72-hour notification to the regulator; contents; communication to individuals where high risk, and the three exceptions (accessed 1 October 2026)
- Data Protection Act 2018, sections 31, 67 and 68 (Part 3, law enforcement processing) — law enforcement purposes; equivalent breach duties; power to restrict what individuals are told to avoid prejudicing an investigation (accessed 1 October 2026)
- ICO: Guide to law enforcement processing, scope and key definitions — processing not for the primary purpose of law enforcement, including internal HR, falls under the UK GDPR (accessed 1 October 2026)
- ICO: Personal data breaches, a guide (updated 20 August 2025) — assessing risk; high-risk threshold for telling individuals; give individuals specific advice on protecting themselves; record all breaches (accessed 1 October 2026)
- Data Protection Act 2018, sections 164A, 165, 168 and 169; UK GDPR Articles 15, 37, 38 and 82 — complaints to controllers (in force 19 June 2026, 30-day acknowledgement); complaints to the Commission; compensation including distress; data protection officers; right of access (accessed 1 October 2026)
- ICO: Can I take legal action against the organisation?; What steps can I take if I've been affected by a personal data breach?; What is a personal data breach? — ICO cannot award compensation; ask the organisation or go to court; independent legal advice; practical steps including Cifas protective registration (accessed 1 October 2026)
- ICO: Getting copies of your information (subject access request) — organisations usually have one month to respond (accessed 1 October 2026)
- ICO: How to make a data protection complaint to an organisation (updated 29 June 2026) — 30 days to acknowledge; outcome without unjustifiable delay; you can complain to the ICO at any time; guidance under review (accessed 1 October 2026)
- GOV.UK: Information Commission succeeds the ICO as UK's data protection regulator (30 September 2026); ICO news release of the same date — new legal entity from 30 September 2026; role and powers unchanged for individuals; still referred to as the ICO (accessed 1 October 2026)
- NCSC: Data breaches, guidance for individuals and families (published 28 January 2021) — check through official channels; scam lures including 'receiving compensation'; passwords; account checks; report@phishing.gov.uk, 7726, Report Fraud (accessed 1 October 2026)
- NCSC: Phishing scams, how to spot and report them — reporting scam emails, texts, calls and websites; what to do if you have shared information (accessed 1 October 2026)
- Dyfed-Powys Police: Statement regarding the 14th September 2026 cyber incident (25 September 2026) — the force's own account of the incident, the ICO notification and the staff-data investigation (accessed 1 October 2026)
- ICO: What price privacy? Poor PSNI procedures culminate in £750k fine (3 October 2024) and PSNI penalty notice — 8 August 2023 disclosure of 9,483 officers' and staff details; £750,000 fine; £5.6 million without the public sector approach; UK GDPR applied (accessed 1 October 2026)
- Police Federation for Northern Ireland: Data breach compensation offer 'is major progress' (February 2026) — £7,500 universal offer; £119 million ring-fenced; exceptional cases may continue legal action (accessed 1 October 2026)
- Northern Ireland Policing Board: PSNI data breach funding allocation (17 December 2025) — Executive approved £119 million to settle claims (accessed 1 October 2026)
- Greater London Authority: Mayor's Question 2023/3403, Met Police data breach (answered 17 October 2023) — Met raised the 2023 incident with the ICO and NCA; review of suppliers with access to employee personal data (accessed 1 October 2026)
- ICO: Suffolk Constabulary reprimand (20 May 2026) — sensitive personal data disclosed in spreadsheets in Freedom of Information responses (accessed 1 October 2026)
- GOV.UK: Opt out of the open register; Electoral Commission: Register to vote anonymously — open register can be bought by anyone; opting out does not affect voting; anonymous registration evidence, including attestation by a police officer of inspector rank or above (accessed 1 October 2026)
- Limitation Act 1980, sections 2, 9 and 11 (legislation.gov.uk) — six years for tort and statutory sums; special rules where damages include personal injury (accessed 1 October 2026)
On this topic elsewhere
More in this guide series
Related pay, pension and protection
Disclaimer
PolicePay.co.uk is an independent reference site. It is not a health, counselling or legal service, and this page is general information, not medical, psychological or legal advice. It cannot consider your personal circumstances. If you are struggling, speak to your GP, a qualified professional or one of the services listed on this page. If you or someone else is in immediate danger, call 999. Details apply to England and Wales unless stated. Details are as checked on 1 October 2026.