The Everyday Data Breaches That Schools Cannot Afford to Ignore

Why human error, everyday administration and simple mistakes deserve as much attention as cyber security

When schools consider the risks of personal data breaches, their thoughts often turn to cyber attacks, ransomware, hackers and sophisticated attempts to gain access to confidential information. These are undoubtedly serious threats, and schools must take appropriate steps to protect themselves. However, some of the most common data protection incidents arise from something far less sophisticated: ordinary people making ordinary mistakes during a busy working day. An email sent to the wrong recipient. A spreadsheet attached without checking its contents. A photograph published without checking permissions. A confidential document left on a printer.

None of these incidents necessarily involves malicious intent, but each can expose personal information and, in some circumstances, have serious consequences for pupils, parents, staff and the school itself.

The important message is that effective data protection is not simply about preventing mistakes. It is also about recognising them, responding appropriately, learning from them and keeping a proper record of what happened.

1. The innocent email that reaches the wrong people

Imagine a school sending a reminder about a parents' evening to 250 families. The message itself is harmless, but instead of using the BCC field, the sender places every parent's email address in CC. Suddenly, hundreds of families can see one another's contact details.

This is a personal data breach because personal information has been disclosed to people who were not authorised to receive it. The consequences may be relatively limited, but they could be more serious where an address reveals someone's identity, circumstances or association with a sensitive service.

The ICO has repeatedly highlighted email addressing errors as an important source of personal data incidents. Good practice includes using approved bulk communication systems, checking recipients and attachments, and considering whether a school communication platform would be safer than ordinary email. A particularly important lesson is that BCC is a useful safeguard, but it is not a substitute for checking whether the message should be sent at all.

2. When the wrong attachment reveals far too much

A teacher intends to send a parent their child's progress report. Unfortunately, the attached document belongs to another pupil. Now imagine that the attachment contains information about special educational needs, medical circumstances, behaviour or safeguarding concerns. What began as a routine administrative mistake could have serious implications for the child concerned.

A related problem occurs when schools respond to subject access requests. Documents may contain references to other pupils, parents or staff. Those references sometimes need to be removed or withheld before disclosure. Simply placing a black rectangle over text in a PDF does not necessarily remove the underlying information. Improperly redacted text may remain accessible through copying, searching or document editing. Schools should use appropriate redaction tools and check the final version before disclosure. This is particularly important where information concerns vulnerable children, domestic abuse, safeguarding investigations or sensitive family circumstances.

The UK GDPR requires personal data to be processed securely. Article 5(1)(f) establishes the integrity and confidentiality principle, while Article 32 requires appropriate technical and organisational security measures.

3. The photograph that should never have been published

School photographs are an important part of celebrating achievement, communicating with parents and promoting school activities. However, the risks increase when schools rely on staff remembering which children can appear in publicity. A teacher may remember that a particular pupil was photographed previously, without realising that the family's preferences have changed. A child might have permission to appear in an internal school display but not on a publicly accessible website or social media account.

In other cases, publishing an identifiable photograph could create safeguarding risks, particularly where a child or family requires additional protection. Schools should maintain an accurate, accessible and regularly updated record of photographic permissions, objections and relevant safeguarding restrictions.

It is also important to distinguish between consent for publicity and other lawful uses of photographs. UK GDPR consent is not automatically required for every school photograph, and safeguarding considerations may justify restrictions even where consent has been given.

The lesson is simple: never rely solely on someone's memory when a reliable record should be available.

4. The breaches that happen away from a computer

Not every breach involves email or digital systems. Consider these familiar situations:

• A confidential staff document is left in a meeting room.

• A pupil's medical information is displayed where visitors can read it.

• A printed safeguarding record is placed in the wrong envelope.

• A member of staff discusses a sensitive family situation within earshot of other parents.

• A paper file is taken home and subsequently lost.

• A classroom screen reveals confidential pupil information behind the application currently being used.

These situations demonstrate why information governance must extend beyond IT security.

Physical security, confidentiality, staff awareness and sensible working practices are just as important.

5. Reporting a breach does not automatically mean reporting it to the ICO

One of the most important distinctions for schools to understand is the difference between reporting an incident internally and notifying the Information Commissioner's Office.

The UK GDPR establishes two different obligations.

Article 33 – Notification to the supervisory authority

A personal data breach must be reported to the ICO unless it is unlikely to result in a risk to the rights and freedoms of individuals. Where notification is required, it must be made without undue delay and, where feasible, within 72 hours of the organisation becoming aware of the breach.

Article 34 – Communication to affected individuals

Where a breach is likely to result in a high risk to individuals' rights and freedoms, those affected must generally be informed without undue delay, subject to the statutory exceptions.

These are risk-based requirements. The mere fact that personal data has been disclosed incorrectly does not automatically mean that the ICO must be notified. Equally, the absence of malicious intent does not mean that an incident is harmless.

The ICO's guidance explains the importance of assessing the likely impact on individuals, taking account of the information involved, the circumstances of the incident and the potential consequences.

Three different outcomes

Situation	Appropriate response
A minor breach unlikely to pose a risk to individuals	Record internally, investigate and take proportionate action. ICO notification not normally required.
A breach likely to pose a risk to individuals	Record, contain, investigate and notify the ICO within the statutory timeframe.
A breach likely to pose a high risk to individuals	Notify the ICO and generally inform affected individuals without undue delay, unless an exception applies.

For example, a misdirected email containing a routine appointment reminder may be relatively low risk, depending on its context and recipient. By contrast, a disclosure revealing a child's protected address, sensitive safeguarding history or details of an abusive family relationship could present a much greater risk. The correct decision depends on the circumstances, not simply the number of records involved.

Importantly, the 72-hour period is not permission to wait three days before taking action. Schools should respond promptly, contain the breach and seek advice as soon as possible.

6. Why every personal data breach should be recorded

Even when an incident does not meet the threshold for ICO notification, it should still be recorded internally. Article 33(5) of the UK GDPR requires controllers to document personal data breaches, including the facts, effects and remedial action taken. This documentation must enable the ICO to verify compliance.

A useful internal breach record should therefore capture:

• When the incident occurred and when it was discovered.

• What happened and what personal information was involved.

• Which individuals were affected, or potentially affected.

• The immediate action taken to contain the incident.

• The assessment of potential harm.

• Whether ICO notification or communication with individuals was required, and why.

• Any safeguarding considerations.

• The measures introduced to prevent recurrence.

This is not bureaucracy for its own sake. If a school records repeated incidents involving the wrong email attachments, that information may reveal a training or procedural weakness. If several breaches involve incorrect pupil contact details, the problem might lie in the school's processes for maintaining accurate records. Without a central record, each incident can appear isolated. With one, patterns become visible.

7. The Insight Information Governance Master Record

For schools and academies subscribing to Insight Management Services and Information Governance Ltd, I recommend using the Insight Information Governance Master Record.

This is designed as a one-stop record of important information governance activity, including personal data breaches, subject access requests, Freedom of Information requests, complaints and other relevant matters.

Its value is not simply that it provides somewhere to record incidents. It also helps schools demonstrate accountability, track actions, identify recurring problems and maintain a clear history of decisions.

A school might experience several minor breaches during the academic year, none of which individually requires notification to the ICO. However, taken together, those incidents could indicate a need to review staff training, communication systems or internal procedures.

A properly maintained Master Record helps identify these issues before they become more serious. The record should be accessible only to appropriately authorised staff, with particularly sensitive supporting information kept securely and linked or referenced where necessary.

8. A culture of reporting, not hiding mistakes

One of the greatest dangers is not the original mistake but the failure to report it. A member of staff who realises that they have sent an email to the wrong person may be embarrassed or worried about disciplinary consequences. If they report the incident immediately, the school may be able to recall the message, contact the recipient, request secure deletion and take other steps to reduce the risk. If they say nothing, the school loses that opportunity. Staff should therefore understand that reporting an accidental mistake promptly is expected and encouraged.

This does not mean that deliberate misconduct, repeated carelessness or unauthorised access should be ignored. It means that the school's response should be fair, proportionate and focused on protecting individuals.

The DfE's September 2026 cyber security standards specifically emphasise creating a culture in which staff feel comfortable reporting risks and incidents.

9. Data protection is everyone's responsibility

A school may have an excellent Data Protection Officer, comprehensive policies and a well-managed IT system. Nevertheless, these measures cannot prevent every human mistake.

The responsibility for protecting personal information is shared across the organisation.

Senior leaders must provide appropriate resources and support. Governors and trustees must exercise oversight. Administrative staff, teachers, teaching assistants and other colleagues must understand how to handle the information they use.

The DPO has an important advisory and monitoring role, but should not be expected to take personal responsibility for every administrative error or every decision made by the school.

The DfE's Data protection in schools guidance and digital technology standards reinforce the importance of appropriate procedures, training and organisational accountability.

10. Five minutes of prevention can save days of investigation

The practical steps are often straightforward. Check the recipient before sending confidential information. Open attachments before sending them. Use appropriate communication platforms and secure access arrangements. Verify photographic permissions. Keep paper records secure. Ensure staff know exactly how to report an incident. Where an error occurs, act quickly and document the response.

And remember that a breach does not have to be serious enough for ICO notification to deserve attention.

Sometimes a minor incident is simply an unfortunate mistake. Sometimes it is the warning that prevents a much more serious breach.

Final thoughts

Schools are busy environments. Staff manage considerable volumes of information, often while dealing with competing demands and urgent situations. Mistakes will occasionally happen. The measure of an effective information governance system is not whether it can guarantee that no mistakes will ever occur. It is whether the school has taken reasonable steps to prevent them, can identify and respond to incidents promptly, and learns from what has happened.

A well-maintained internal breach record is a vital part of that process. For Insight subscribers, the Information Governance Master Record provides a practical way of bringing those responsibilities together. Because the breach you record today might be the one that helps you prevent a much more serious incident tomorrow.

Legislation and official guidance

The following sources support the article and provide further reading for schools:

• UK GDPR, particularly Articles 5(1)(f), 24, 32, 33 and 34, together with the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

• ICO – Personal data breaches: a guide. Explains notification thresholds, the 72-hour requirement and recording all breaches.

• ICO – Breach response and monitoring. Recommends central logging, including near misses, and recording remedial action.

• DfE – Data protection in schools. Covers policies, procedures and information security.

• DfE – Cyber security standards for schools and colleges. Updated September 2026, including incident reporting and staff awareness.

  
  

© Steve Cullen, Insight Management Services and Information Governance Ltd | October 2026