Healthcare: A High Risk in the GDPR Minefield
- Details
- Published: Tuesday, 14 October 2025 09:45
- Written by Peter Ingle
- Hits: 333
Large scale GDPR breaches have involved companies such as British Airways, Marriot, Google and H & M. They received significant fines and in some cases were subject to separate actions by those affected as well as reputational damage. It is not just household names that are vulnerable.
Recent figures reveal that the UK Health Sector is one of those most affected by GDPR breaches. Between 2023 and Q1 2025, health businesses self-reported 3,820 incidents. This represents a significant proportion of the nearly 22,000 cases of businesses and public sector organisations self-reporting data breaches to the Information Commissioner’s Office (ICO).
Indeed, the health sector has the highest rates of self-reporting for personal data breaches, between 2023 and 2025. This exceeded the number coming from education and childcare (3,246), retail and manufacturing (2,385) and finance, insurance and credit (2,175).
Many of these sectors are also heavily regulated and operate under close public scrutiny. Because of this, organisations often adopt a risk-averse reporting approach, which might suggest that there would be more reports if there was less concern about a punitive response.
In 2024 UK businesses reported a greater number of data breaches than ever before with 69% of organisations surveyed having self-disclosed a data breach or potential data breach to the ICO in the year. This represents an increase from 53% in 2024.
This change, according to support organisations, suggests that businesses are beginning to take greater ownership over their breach response strategies and are stepping up to take responsibility.
UK GDPR legislation defines a personal data breach as a: “breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.”
Examples include sending an email to the wrong recipient, a lost laptop containing personal data, a cyberattack that exposes customer records or staff sharing sensitive data inappropriately or without authorisation, all examples that could conceivably affect a dental practice.
Legally, organisations must report a breach to the ICO within 72 hours of becoming aware if it poses a risk to individuals’ rights and freedoms. In some cases, they must also notify the affected individuals, who can be employees, customers, members of the public, and third-party suppliers or partners.
When an organisation self-reports a breach, the ICO will review the events, what kind of personal data was involved and assess whether individuals are at risk. It will evaluate the organisation’s response and provide guidance or take enforcement action in more serious cases.
While the focus in the aftermath of a personal data breach is on harm reduction for those directly affected, there is less attention paid to the negative impact breaches can have on employee wellbeing, morale and productivity within the health sector.
Chris Britton, People Experience Director at HR advisers Edenred, commented: “A data breach can have far-reaching consequences for health businesses and it is right they place emphasis on meeting legal requirements and customer needs in the aftermath. But often the impact on the workforce is overlooked which could delay and damage both short- and long-term recovery from an incident.
“The period after a data breach is discovered is an extremely stressful, disruptive and uncertain time for an organisation and its employees. Many will feel a sense of guilt over the breach, even if they followed protocols.”
His suggestions to reduce the likelihood of data breaches and protect employee well-being included appropriate training and encouraging a work life balance, given the human error that underlies many breaches.
You need to be logged in to leave comments.
Report
My comments