Human error, the human element and non-cyber incidents are different measures. This page explains what the ICO’s UK incident data and Verizon’s international breach study actually count, with dates and denominators beside the figures.
Headline claims about human error vary because studies use different populations and definitions. ICO data categorises reported personal data breaches by incident type; the government survey records identified cyber breaches and attacks; Verizon’s DBIR examines contributed international incident data. None supplies a universal percentage of all UK breaches directly caused by employee mistakes.
It is scoped to the causes of breaches: the human-error share, the mistake types behind it, and the training gap. For how many breaches are reported overall, sector volumes and costs, see our UK data breach statistics page.
Key facts and figures
- 76.7% of Q4 2025 incidents in the ICO trends extract were classified non-cyber — 2,821 of 3,677. This is not a human-error percentage.
- 607 Q4 2025 incidents involved data emailed to the wrong recipient — 16.5% of the 3,677 unique incidents in the ICO extract.
- 88% of errors in the public-sector sample involved misdelivery in Verizon’s 2026 DBIR sector snapshot.
- 62% of breaches worldwide involved the human element in the 2026 DBIR, up from 60% in the 2025 edition.
- 90% was CybSafe’s historical estimate of end-user mistakes within reported cyber breaches in 2019, not an official ICO human-error measure.
- 19% of UK businesses ran cyber security awareness training in the year before the 2025/26 Cyber Security Breaches Survey — while 43% identified a breach or attack.
- 201 Q4 2025 incidents were classified as failure to redact in the ICO trends extract.
- £3.13 million — the mean UK breach cost in IBM’s 2026 study of breached organisations.
Figures were checked on 15 October 2026. Each source measures a different population and period; vendor study results and regulator classifications should not be treated as interchangeable estimates of human error.
What percentage of data breaches are caused by human error?
The ICO’s Q4 2025 trends extract contains 2,821 non-cyber incidents out of 3,677 unique incident references, or 76.7%. It includes categories such as wrong-recipient emails, unauthorised access, loss or theft and unspecified incidents. It does not establish that all non-cyber incidents are accidental or caused by an employee.
Globally, the 2026 Verizon DBIR found the human element — a person making a mistake or being successfully socially engineered — present in 62% of the 22,000+ confirmed breaches it analysed, up from 60% in the 2025 edition.
The following figures illustrate why definitions matter. Some measure categories of reported incidents; others measure a human contribution or a particular type of error within a study sample.
| Figure | Source and year | What it actually measures |
|---|---|---|
| 62% | Verizon DBIR 2026 | Breaches worldwide involving the human element — error or social engineering — across 22,000+ confirmed breaches |
| 16.5% | ICO trends, Q4 2025 | 607 wrong-recipient email incidents divided by 3,677 unique reported incidents |
| 76.7% | ICO dataset, Q4 2025 | 2,821 incidents classified non-cyber out of 3,677; not a direct-cause human-error measure |
| 5.5% | ICO trends, Q4 2025 | 201 incidents classified failure to redact out of 3,677 |
| 88% | Verizon DBIR public-sector snapshot, 2026 | Misdelivery as a share of errors in its public-sector sample, not all global breaches |
| 90% | CybSafe, 2019 analysis | End-user mistakes across the 2,376 cyber breaches reported to the ICO in 2019 |
| 2.6% | ICO trends, Q4 2025 | 96 incidents classified failure to use bcc out of 3,677 |
These percentages cannot establish that human error directly causes six to eight in every ten UK breaches. A sound comparison needs the source, population, time period and definition, including whether the measure describes a cause, a contribution or an incident classification.
What does the ICO's non-cyber breach data show?
Non-cyber incidents accounted for 76.7% of the Q4 2025 trends extract. Categories include data sent to the wrong person, redaction failures and lost paperwork, but also unauthorised access and unspecified events. Cyber incidents can also involve human actions, so the two categories do not divide breaches neatly into people problems and technical problems.
Health had the largest reporting volume in that quarter with 647 incidents, followed by education and childcare with 518. These are sector counts, not adjusted rates or evidence about why an incident occurred. They do not establish that a particular sector’s staff make more mistakes.
The extract records 1,986 incidents affecting one to nine people, or 54% of the quarter’s total. It also has 1,479 incidents without an assigned decision, so a final no-action rate cannot be inferred from this snapshot. Breaches must be notified unless unlikely to create a risk to people, without undue delay and, where feasible, within 72 hours of awareness.
What is the most common human error data breach?
Data emailed to the wrong recipient was recorded for 607 incidents in Q4 2025, or 16.5% of the total. It was the largest specified incident type, although the unspecified Not Provided category was larger at 649. Other categories included 188 wrong-recipient post or fax incidents, 201 redaction failures and 96 failures to use bcc.
Verizon’s 2026 public-sector snapshot reports misdelivery in 88% of errors in that sector sample. This supports the importance of recipient checks, but it is not a figure for all global errors or for the share of UK breaches caused by email.
The ICO examined why these mistakes keep recurring in the Errors chapter of its May 2024 review, Learning from the mistakes of others. The pattern it describes is consistent: routine tasks, time pressure, autocomplete picking the wrong contact, and personal data attached where it did not need to be — failures that layered checks, technical controls and staff training are all designed to catch before the send button is pressed.
Why do human-error percentages differ?
The source population makes a substantial difference. A survey of employees, a collection of investigated breaches and a regulator’s incident reports will identify different risks. A percentage from one of those sources should not be applied to all businesses or all incidents without evidence that the population and definition match.
A claim that an incident involved a human action is broader than a finding that a mistake directly caused it. Technical weaknesses, attacker behaviour, organisational decisions and individual actions can contribute to the same incident. Adding percentages from overlapping categories would double-count events.
For historical context, CybSafe’s 2020 release attributed 90% of the 2,376 reported cyber breaches it analysed for 2019 to end-user mistakes. That was the company’s interpretation of ICO data at the time, not an official ICO cause statistic or a current estimate. It also concerns cyber incidents, unlike the non-cyber share above.
What does the Verizon DBIR say about the human element?
Verizon’s 2026 DBIR reports a human element in 62% of breaches, compared with 60% in the previous edition. It analysed more than 31,000 incidents and 22,000 confirmed breaches across 145 countries, with data covering October 2024 to November 2025. This international contributed dataset is not a representative survey of all UK organisations.
Its public-sector snapshot puts the Miscellaneous Errors pattern at 31% of public-administration breaches and misdelivery at 88% of errors in that sector. The different denominators matter: the first figure is a share of breaches, while the second is a share within the error category.
How big is the security awareness training gap?
In the Cyber Security Breaches Survey 2025/26, 19% of businesses reported staff cyber training or awareness-raising in the previous 12 months; 43% identified a breach or attack. These separate measures do not prove that lack of training caused the attacks, and the absence of a recent training session does not establish that staff had never been trained.
IBM’s 2026 study reported a £3.13 million mean UK breach cost among participating breached organisations. That is not a cost estimate for a typical misdirected email. The ICO’s error guidance recommends appropriate organisational and technical controls; training is one part of that wider approach.
Training is also a compliance expectation, not just good practice: UK GDPR's security and accountability principles require appropriate organisational measures, and the ICO expects staff who routinely handle personal data to be trained to do so. That is precisely the gap a short, accredited course closes.
Frequently asked questions
What percentage of data breaches are caused by human error?
There is no single verified percentage for all UK breaches. Non-cyber incidents were 76.7% of the ICO’s Q4 2025 trends extract, but that is not a human-error measure. Verizon reported a human element in 62% of its international 2026 breach dataset, using a different definition and population.
What is a non-cyber data breach?
Non-cyber is an ICO classification that includes types such as misdirected information, redaction failures, lost paperwork and unauthorised access. It accounted for 2,821 of 3,677 Q4 2025 incidents, or 76.7%. It does not mean every incident was accidental or caused by an employee.
How many data breaches are caused by misdirected email?
The ICO’s Q4 2025 extract contains 607 wrong-recipient email incidents, or 16.5% of 3,677 unique incidents. This describes reports in that dataset, not every misdirected email or every UK data breach.
Is the "95% of breaches are human error" statistic true?
It should not be used as a universal current UK rate. Studies that describe human involvement, direct mistakes and non-cyber incidents measure different things. Use a figure only with its original source, period, population and definition.
Does an employee mistake count as a personal data breach under UK GDPR?
Yes, an accidental disclosure can be a personal data breach. A controller must report it unless it is unlikely to result in a risk to people’s rights and freedoms, without undue delay and, where feasible, within 72 hours of awareness. Even a breach that is not notified must be documented.
Do most human error breaches lead to ICO fines?
An incident report does not automatically lead to a fine. The ICO considers the nature and seriousness of the infringement and the organisation’s circumstances. The Q4 2025 trends extract contains many cases without a decision assigned, so it is not a final fines-rate table.
Related guides
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- GDPR data breach: what to do in the first 72 hours
- GDPR fines and penalties in the UK: how big, who pays, what counts
- What is GDPR? A UK guide to the General Data Protection Regulation
- Who does GDPR apply to? Scope and enforcement in the UK
Sources & references
- ICO — data security incident trends, Q1 2019 to Q4 2025
- ICO — Learning from the mistakes of others: errors
- DSIT and Home Office — Cyber Security Breaches Survey 2025/26
- Verizon — 2026 DBIR executive summary
- Verizon — 2026 DBIR public-sector snapshot
- CybSafe — historical analysis of reported cyber breaches in 2019
- IBM — UK Cost of a Data Breach Report 2026 findings
- ICO — personal data breach reporting
Most reported breaches start with an everyday mistake — a misdirected email, an unredacted file. Train your team to handle personal data safely and meet UK GDPR duties.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.