ICRIR Statement: Data breach

The ICRIR experienced a limited data breach on the afternoon of Tuesday, March 18 2025.

The names of 25 people, principally Requesting Individuals (RI), were mistakenly disclosed to a single recipient who had previously sought assistance from the Commission.

This was caused by an administrative error in an email address field. No sensitive or special category information was disclosed. The mistake was discovered within several hours and addressed swiftly.

The recipient has confirmed the information was deleted.

All affected RIs have been contacted, with a sincere apology and offer of further advice or support.

All other RIs, including those no longer with the Commission, have also been advised. 

The Commission takes very seriously its responsibilities in protecting the privacy of individuals and the security of information entrusted to us.

The Commission is very sorry for this error.

An internal investigation is now underway, and a full report has been sent to the Information Commissioner’s Office.