Spotlight on the Irish Data Protection Commission’s Annual Report: Personal Data Breaches
- Published
- in Industry Updates
What You Need to Know
On 30 June 2026, the Irish Data Protection Commission (“DPC”) published its annual case studies booklet (“Booklet”) alongside its 2025 annual report (“Report”).1
This article is the fourth in our Spotlight on the Report series.2 The Report records that the DPC received 6,521 valid breach notifications in 2025. This was a 16% decrease on 2024 and almost half of these breaches resulting from correspondence being sent to the wrong recipient.3
In this article we examine the DPC’s personal data breaches case studies, which highlight common causes of personal data breaches and the DPC’s approach to such breaches.
Accidental Disclosure by Bank (Case Study 23)
An individual complained to the DPC after receiving another customer’s personal data in the post from their bank. The DPC investigated and the bank confirmed that an accidental disclosure of a third party’s data had occurred (with the complainant as the unintended recipient), but that no breach of the complainant’s own personal data had taken place.
The complainant remained concerned even after being informed of the bank’s position but was unable to point to anything indicating their own data had been compromised. On that basis, the DPC found it could not establish a GDPR infringement.
Key Takeaway: This case illustrates the importance of ensuring that contact details are reviewed for accuracy prior to sharing personal data with a third party. This simple step can help to avoid personal data breaches, associated notification obligations and potential reputational harm.
Unlawful Disclosure of Financial Information (Case Study 24)
A family member of a vulnerable adult who lacked capacity to manage their own affairs contacted the DPC after a financial institution sent a letter containing the individual’s sensitive financial information to the residential facility where they resided. The letter was addressed to the facility itself rather than to the individual.
As a result, the residential facility received and had access to financial information it was not entitled to see.
On investigation, the financial institution acknowledged the addressing error, confirming that the correspondence should have been sent to the individual c/o the residential facility, rather than to the facility directly. It accepted that it had no lawful basis for disclosing the customer’s sensitive financial data to the facility in this manner.
Key Takeaway: Similar to Case Study 23, this case illustrates the importance of verifying contact details before sharing personal data.
Complaint Email Forwarded in Error (Case Study 26)
An email containing details of a complaint made against one of its coaches was sent to a sports club’s Child Safety Officer and then, in error, forwarded to one of the coaches at the sports club. The email was subsequently read aloud at a meeting attended by several coaches, during which the identity of the original sender was also disclosed.
The DPC found that the sports club had no designated individual responsible for data protection matters and had no formal data protection training or awareness programme in place. The incident revealed deficiencies in how the sports club handled sensitive communications, including a failure to ensure that emails containing personal data were properly addressed and directed only to their intended individual recipients.
Key Takeaway: This case is a useful reminder that, while in certain circumstances a verbal disclosure may fall outside the scope of the GDPR, where the personal data originated in an email, the GDPR and data protection obligations apply regardless of an organisation’s size and formal resourcing.
Inadvertent Disclosure of Personal Data by School (Case Study 27)
A secondary school student observed a teacher entering their password into the school’s education administration system, memorised it and then used it to access the system without authorisation over a five-month period. Subsequent investigation revealed that the underlying incident had occurred 18 months earlier.
The school only became aware of the breach after being alerted by a parent. At the time of school’s initial notification to the DPC, the school could not confirm whether vulnerable individuals were among those affected and, on that basis, classified the breach as low risk.
The DPC, however, assessed the breach as high risk due to: (i) the extended period over which the student had unauthorised access to the system, (ii) the significant number of students affected, a considerable subset of whom fell within the vulnerable category and (iii) the fact that the data accessed included special category data.
The DPC’s assessment also revealed that the school had limited familiarity with its data protection obligations and had not implemented appropriate technical and organisational measures to secure the personal data in its charge.
Key Takeaway: This case is an important reminder of the importance of robust password and access-management practices, regular staff training and proactive monitoring of systems, particularly where an organisation is handling personal data relating to children or vulnerable individuals.
Unsecure Email Systems (Case Study 30)
A GP surgery patient entered an incorrect email address on a form during an appointment, and this address was recorded without any verification. As a result, email correspondence containing the patient’s personal data was sent to an unintended third-party recipient and this correspondence was transmitted in unencrypted format.
Following engagement with the DPC, the surgery conducted an internal review of its systems, which identified two key issues: (i) the practice was using a generic, free email account to communicate with patients and (ii) no encryption was applied to the content of these communications.
In response, the surgery implemented a number of remedial measures. It migrated to a more secure, paid email service and transferred all historical emails to the new system. It introduced a process to ensure all correspondence, including test results, is now encrypted.
It rolled out staff training on use of the new system and encryption protocols. Finally, it began implementing a secure patient portal, which allows patients, with their consent, to access and share documents through a two-factor authentication protected login. Once fully rolled out, this portal will replace email for sending patient documents, significantly enhancing the security of patient communications.
Key Takeaway: This case demonstrates the importance of ensuring security features are configured appropriately to the nature of the processing and that the accuracy of personal data is verified at the point of collection.
Loss of Documents in the Post (Case Study 31)
A national regulatory authority notified the DPC of a personal data breach after an individual reported that they had not received official documents, including an original official ID and new official documentation, that had been expected by post. Following an internal investigation, the authority concluded that the documents were irretrievably lost.
The DPC’s assessment revealed that the documents had initially been sent by standard post. When the authority became aware they were missing, it attempted to recover them by sending a registered letter to the same address, but this was returned as undeliverable due to an incomplete address. The investigation traced this back to a manual application in which the individual had provided a handwritten address that was missing certain details, although the Eircode used was correct. The authority subsequently issued replacement documentation to the individual by registered post, using the full and correct address.
Following engagement with the DPC, the authority adopted several updated processes and policies, including a requirement that all documents containing personal data must be sent by registered post; a verification process for customer data and implementing a “single customer view/master data record,” linked across its various internal databases, to help keep personal data accurate and up to date.
Key Takeaway: This case highlights the challenges organisations can face in meeting their data protection obligations where manual, paper-based processes are involved, and the costs that can arise from relying on outdated or unverified data collection methods. It demonstrates that centralised and accurate customer data records can materially reduce the risk of a breach and can support faster remediation when errors occur.
Recommended Actions
These case studies show that many personal data breaches arise from avoidable, process-level failures such as inaccurate contact details, unverified information-sharing practices, weak password and access controls, and unsecured communication channels.
In light of the above case studies, we recommend organisations take the following steps:
- Verify and regularly review recipient contact details before sharing personal data (particularly sensitive personal data) to reduce the risk of accidental disclosure to unintended recipients.
- Implement clear recipient verification and information-sharing controls for communications involving sensitive personal data such as complaints or safeguarding matters to ensure the information is directed only to designated individuals.
- Strengthen password and access management practices and implement proactive monitoring for unauthorised access.
- Provide regular data protection and information security training to all staff, covering secure information-handling and how to identify and report a suspected personal data breach.
- Ensure that security features are configured appropriately to the nature and sensitivity of the processing and consider secure alternatives to email, such as authenticated portals, for sharing sensitive documents.
- Where sensitive personal data or identification documents are being sent by post, use registered post or another trackable delivery method and maintain accurate and centralised customer data records to minimise reliance on manually provided or unverified information.
Further Information
Our Data Protection team is available to assist in reviewing and strengthening data protection compliance frameworks. We would encourage organisations to act now to address any gaps, rather than waiting for a complaint.
For more on the Report, please see our other updates4 and/or visit our knowledge page5.
If you would like to discuss the topics considered here or require any further information, please liaise with your usual Maples Group contact or any of the persons listed.
1 https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
2 Our Spotlight on the DPC Report series consists of the following articles: (i) Key Findings; (ii) Practical Takeaways for Employers in Ireland; and (ii) Data Subject Access Requests
3 Please see Practical Takeaways for Employers in Ireland for an overview of case studies 25, 28 and 29 which concern personal data breaches in an employment context.
4 Our Spotlight on the DPC Report series consists of the following articles: (i) Key Findings; (ii) Practical Takeaways for Employers in Ireland; and (ii) Data Subject Access Requests
