Category: Cyber Security | Published: 2026-10-13
Police data protection failures are not simply a matter of misplaced paperwork. When confidential details reach the wrong person, the consequences can include unwanted contact, intimidation and risks to someone's safety.
Questions about mandatory training at the Metropolitan Police have brought that responsibility into focus. Figures discussed at the London Assembly suggest a substantial training shortfall, while the Information Commissioner's Office has already identified weaknesses following two disclosures involving sensitive investigations.
The story offers an important lesson for any organisation holding personal information: a policy is only useful if people understand it, supervisors check it and working processes help prevent mistakes.
At the London Assembly's Police and Crime Committee on 23 September, Kenny Bowie, director of strategy and MPS oversight at the Mayor's Office for Policing and Crime, was questioned about training compliance.
Some reporting highlighted a completion rate of 30%. His reported account referred to an earlier figure of approximately 30–40%, indicating that a large proportion of personnel had not completed the mandatory training.
The distinction matters. That range should not be treated as an exact, up-to-date measurement of every officer's training status. It still points to a significant compliance problem, but precision about the evidence helps keep the discussion fair.
Bowie acknowledged the need for improvement and referred to responsibilities for individuals and supervisors, alongside technical safeguards. He did not provide a firm timetable for reaching substantial compliance, leaving questions about how quickly the shortfall would be addressed.
Police records may contain addresses, telephone numbers, witness details and information connecting someone to a highly sensitive investigation. The need to protect that information can be especially urgent when the person has already experienced threats or harassment.
The ICO's announcement on 5 August 2026 confirmed an enforcement notice and reprimand following two incidents at the Met.
The regulator found that the force had not put appropriate technical and organisational measures in place, identifying an infringement of section 40 of the Data Protection Act 2018. Its investigation also found inadequate monitoring and governance around training compliance.
These were not treated as two unrelated slips by individual employees. The ICO identified wider weaknesses in the arrangements intended to keep sensitive information safe.
The first incident concerned documents for a Stalking Protection Order. An officer sent the material to the defendant without removing confidential information.
The documents included the victim's new address and telephone number, as well as names and contact details for three witnesses. The victim had changed her details because of the risks she faced.
The defendant subsequently contacted her on the new number and said he had obtained it from documents supplied by the police.
This shows why redaction is not a cosmetic step. Removing information that a recipient should not receive can be essential to protecting the people mentioned in a document.
The ICO found that relevant officers had not received the required specialist training for Stalking Protection Orders. It also found that the process for preparing and checking the documents was inadequate.
The failure therefore involved both knowledge and procedure. Staff needed to understand what should be removed, while the checking process needed to catch an omission before the documents left the organisation.
The second incident involved 18 people linked to the UK Parliament. They had been targeted through WhatsApp messages in a suspected attempt to obtain compromising information.
An officer sent a group email about a change to the suspect's bail date, placing the recipients in the "To" field. Everyone receiving it could see the other people's names and email addresses.
The message did not need to describe each person's private circumstances for the disclosure to matter. Its context could allow recipients to infer sensitive information about others' connection to the investigation.
The ICO concluded that a more appropriate communication method should have been used rather than one bulk email in such sensitive circumstances.
This is more than a reminder about the difference between To, Cc and Bcc. Hiding addresses can reduce one risk, but it does not automatically make a group email suitable for every situation. Individual messages or a secure communication service may be more appropriate where the identities of the people involved are themselves confidential.
The officer responsible for the email had not completed data protection training for more than four years before the incident. The line manager had gone almost four years without relevant training.
That finding matters because supervision is part of the safeguard. A manager who is not familiar with the guidance may be poorly placed to spot risky practices, challenge an unsuitable process or help an employee make a careful decision.
Mandatory training should therefore cover managers as well as frontline staff. It also needs follow-up when courses are overdue, rather than relying indefinitely on reminders that people can ignore.
The Met notified affected people and offered additional support in the stalking case. It also delivered further specialist training and strengthened the multi-stage checking process for Stalking Protection Order applications.
After the email disclosure, the force reminded personnel about mandatory training and introduced an alert tool designed to warn staff when sending messages to multiple external recipients.
These are practical steps, but the ICO found that more action was needed. Training completion remained low, while some wider technical and monitoring improvements had not been fully implemented or shown to work effectively.
The enforcement notice required improvements to training compliance, monitoring and governance, with three-month and 12-month deadlines for different measures.
Introducing a safeguard and demonstrating that it works are separate tasks. A warning message has limited value if staff dismiss it automatically or cannot identify which alternative communication method to use.
The circumstances involve policing, but the underlying risks are familiar to businesses. Customer correspondence, employee records, complaint files and sensitive documents can all expose people if handled carelessly.
Start by checking whether required training is actually complete. Identify overdue courses, include managers in the review and give staff time to learn. Someone should be responsible for following up, not merely sending another reminder.
Then check understanding. A completion certificate does not prove that an employee knows how to redact a document correctly or decide whether a group message is appropriate.
Short, realistic exercises can reveal uncertainty before it becomes an incident. Ask staff what they would remove from a sample document, how they would contact customers whose identities must remain confidential and when they should seek advice.
Training works best alongside a process that supports it. For sensitive disclosures, define who prepares the material, who reviews it and which checks must happen before release.
Review the communication tools staff use. An email warning can help, but employees also need clear instructions about what to do when it appears. Where a secure service or individual message is required, make that option available and understandable.
Pay attention to workload and supervision as well. Rushed staff, unclear responsibilities and unsuitable software can undermine good intentions. Protecting information is a management responsibility, not something that can be delegated entirely to the person pressing Send.
If your team needs practical guidance on recognising risks and handling information more carefully, our Awareness Training page explains how we can help build safer working habits.
After a disclosure, it is tempting to focus on who sent the document or email. Accountability matters, but stopping there can leave the same weakness in place for the next person.
Ask whether guidance was clear, whether specialist training was available, whether supervisors were prepared and whether the review process could realistically catch an error. Check whether technical controls were functioning and whether anyone monitored compliance.
The police data protection failures identified by the ICO show why these questions belong together. A preventable disclosure may reflect several missing safeguards rather than one isolated decision.
The lesson is not that training alone can prevent every breach. It is that training, supervision, document checks and suitable communication tools need to work as a system.
For organisations trusted with personal information, the useful test is practical: can staff explain the rules, apply them under normal working conditions and obtain help when a situation is sensitive or unclear?
Closing that gap is more meaningful than counting policies or assuming that a reminder has solved the problem. It gives the people sharing their information a stronger reason to trust that it will stay protected.
Photo: Met Police Blue Lamp by Canley , via Wikimedia Commons. Released into the public domain by the photographer. Illustrative archive photograph, not an image of either disclosure.
