Almost every job handles information about people: customers, clients, patients, pupils, colleagues. The law treats that information as something your employer must protect, and in practice that means you. This is not only an IT matter. Most breaches come from ordinary mistakes on an ordinary day.
How breaches really happen
A 'data breach' sounds like hackers. The ICO's own list of the incidents reported to it is far more everyday:
| What happened | What it looks like |
|---|---|
| Emailed to the wrong person | Autocomplete picked the wrong James. The wrong file was attached. |
| Bcc not used | A group email showed every customer everyone else's address. |
| Lost or stolen device or paperwork | A laptop left on a train. A folder left in a café. |
| Said out loud | A client's details discussed on a phone call in a public place. |
| Thrown away, not destroyed | Printouts with names on put in the ordinary bin. |
Everyday habits that prevent most of them
- Lock your screen every time you leave your deskOn Windows, press the Windows key and L. On a Mac, Control, Command and Q.
- Check the address and the attachment before sendingThe single most useful habit. Most email breaches are caught by this.
- Use only the systems your employer providesNo forwarding work to your personal email, no saving files to your own cloud storage, no client details in personal messaging apps.
- Be careful what you paste into AI tools and websitesUnless your employer has approved the tool, do not put client or customer details into it.
- Keep paper and screens out of sight in publicOn a train or in a café, assume the person behind you can read your screen and hear your call.
- Put confidential paper in the confidential wasteNot the ordinary bin. If you are not sure which is which, ask.
- Never share your password or let someone use your loginWhat happens under your login is treated as you.
Someone asks you for information
People will phone or email asking for details about a client, a customer or a colleague. Some are entitled to it. Some are not, and some are pretending to be someone else. If you are not certain who they are and that they are allowed to have it, do not give it. Take their details, say you will come back to them, and ask your manager.
If something goes wrong
- StopDo not try to fix it quietly or delete the evidence. Do not send a second email that makes it worse.
- Tell someone straight awayYour manager, or whoever your employer's policy names, such as the data protection officer or IT. Straight away means now, not at the end of the day.
- Say exactly what happenedWhat was sent or lost, to whom, when, and whose information was in it.
- Let them take it from thereThey decide whether it must be reported and whether the people affected need to be told.
People are rarely in serious trouble for an honest mistake reported quickly. Hiding one is a different matter.
Not every breach has to be reported. That is your employer's decision, not yours, but the clock means they need to hear from you immediately.