Shropshire Council among worst for serious data breach referrals, figures show

Shropshire Council is among the worst authorities in England for the number of serious data breach referrals.

Research carried out by password management company Passpack showed that the local authority is among the five councils with the highest number of Information Commissioner's Office (ICO) referrals between 2021 and 2025.

It found there were 15 recorded referrals in the most recent year, the fourth highest nationally. ICO referrals cover only the most serious incidents deemed likely to pose a risk to residents.

Shropshire Council also recorded 209 internally logged data breaches in the most recent year, a 57 per cent increase on 2021.

In total, 78 councils responded to Passpack's Freedom of Information request with an average of a 53 per cent in recorded data breaches over the five years, with ICO referrals up 41 per cent.

In the most recent reporting year, those councils collectively recorded 16,902 data incidents and 305 ICO referrals.

Shropshire Council's ratio of internal breaches to ICO referrals is notably tighter than the national average of 50.1, suggesting a higher proportion of incidents meeting the serious breach threshold.

Tim Collard, senior information risk owner at Shropshire Council, said: "Whilst the figures quoted are accurate, we want to assure you that the council takes its responsibility for information security extremely seriously.

"When a personal data breach occurs, the council’s Information Governance Team (IGT) assesses the likelihood of the risk to people’s rights and freedoms.

"Legislation states that ‘if a risk is likely’, the ICO must be notified and the assessment of the risk will depend on the personal circumstances of the person affected. It is important to note that in all cases where the council has heard back from the ICO, the council has been found to have taken all necessary actions in response to the breach."

Mr Collard added that the council takes the following steps to prevent breaches occurring:

• All staff are required to undertake annual data protection and cyber awareness training and in all cases reported, the training has been completed and staff understand their role in protecting information.
• There is a formal procedure in place for reporting breaches. The new training introduced in December 2025 includes details of how to do this. Guidance is included on the council’s intranet. At the time an incident is reported, the IGT looks into the cause and identifies any actions that should be taken to reduce the likelihood of a similar breach happening again.
• The chief executive has written to all staff instructing compliance with the information security policies and guidance.

"The volumes of reported breaches should be seen in light of the council’s ongoing commitment to fostering a more open and mature reporting culture," said Mr Collard.

"We have made a concerted effort to encourage staff to report all actual and potential data breaches, no matter how minor. This proactive approach enables us to investigate thoroughly, learn from each incident, and put improvements in place where required.

"The recorded breaches have risen 57 per cent over a five-year period which is broadly in line with the national average of 53 per cent. Our focus remains on transparency and continuous improvement, ensuring that every incident, however small, helps us strengthen our processes and protect the information we hold and process."