When Data Protection Training Fails: Lessons from the Metropolitan Police

In August 2026, the Information Commissioner’s Office (ICO) announced an enforcement notice and reprimand for the Metropolitan Police Service after two serious personal-data disclosures. The cases are a reminder that a written policy is only a starting point: people need to understand what to do when they handle information under pressure.

The findings concern the organisation and the specific incidents investigated. They are not a claim that every police employee—or every organisation with a training gap—has mishandled data.

What happened in the two cases?

In one case, information in documents connected with a stalking protection order disclosed the contact details of a victim and witnesses to a defendant. In another, an email about a “honeytrap” case exposed the names and email addresses of 18 people to the other recipients. The ICO said weaknesses in training, policy and oversight contributed to the risk of personal information being sent to the wrong people.

The regulator reported that officers and managers involved in the incidents had not completed relevant data-protection training for more than four years. The ICO issued a reprimand and ordered improvements. It is important to describe this as the regulator’s documented finding about the people and processes involved—not as a statistic about every member of staff.

Why a policy is not enough

A policy may correctly say “check recipients before sending” or “share only what is necessary”. But an employee still needs to recognise a risky situation, know which tool to use and feel able to pause or ask for help. A generic annual presentation will not prepare every role equally: a payroll team, receptionist, engineer and case worker handle different information and make different decisions.

Training also needs to connect to the systems people use. If a mailbox automatically suggests an external recipient, a case-management tool makes it hard to restrict access, or staff use broad shared accounts, reminders alone cannot fix the underlying control. Managers are responsible for making the safe way to work practical and for checking that it is followed.

A practical checklist for smaller organisations

1. 1Include data handling in onboarding. Explain what counts as personal or sensitive information, where it belongs and who can approve sharing.
2. 2Train by role. Use realistic examples from the work people do, such as sending payroll files, handling customer complaints or sharing documents with suppliers.
3. 3Refresh and check understanding. Schedule short refreshers after process changes and use a few scenario questions rather than relying only on attendance.
4. 4Keep useful evidence. Record who completed training, when, which version they took and how gaps or failed checks were addressed.
5. 5Make reporting easy. Tell staff how to report a misdirected email or lost device quickly, without first deciding whether it is a formal breach.
6. 6Limit access. Give each role the information and permissions it needs, remove access when duties change and review shared mailboxes and accounts.

For example, a person who sends case files should practise checking recipients and attachments, while someone who manages a mailing list should learn when to use a blind-copy field or a secure distribution tool. Short exercises using realistic, fictional examples help reveal whether a process is understood before a real customer, patient or employee is affected.

If an incident occurs, act quickly: contain the disclosure where possible, preserve the facts, assess who may be affected and follow the organisation’s breach-response process. Do not wait for the next training session to decide what to do. The right response will depend on the information and the circumstances, so get privacy or legal advice when the risk is serious.

For leaders, the test is not simply whether a policy exists or a course was assigned. Can staff explain the safe process? Are access controls proportionate? Are mistakes reported early? Can the organisation show that it learned from them? Those answers turn training from a box-ticking exercise into a working safeguard.

Sources and further reading

ICO: enforcement notice and reprimand →

ICO: Metropolitan Police enforcement notice →

BBC News: Met Police criticised over two data breaches →