Staffordshire Police has been reprimanded after a protection notice meant to shield a domestic abuse victim handed their current home address to the alleged abuser. The regulator found the disclosure unlawful and training completion at the force poor, but stopped short of a fine.
What happened
The UK data protection regulator published a reprimand against the Chief Constable of Staffordshire Police on 28 October 2026. The notice itself is dated 13 October and finds that the force breached sections 35 and 40 of the Data Protection Act 2018, the lawful processing and security principles that govern how police handle personal data for law enforcement purposes.
The man at the centre of the case, referred to only as “P”, left prison around 26 March 2024. The next day a senior Staffordshire officer authorised a Domestic Violence Protection Notice (DVPN), a fast-track notice under the Crime and Security Act 2010 that keeps a suspected abuser away from a victim. As P now lived in Cheshire, Cheshire Constabulary served it on 29 March 2024. It included the victim’s current address, which P had not known.
According to the reprimand, the victim had moved house several times to escape the alleged abuse, so the regulator said the address should have been treated as highly sensitive. The error only surfaced on 3 April 2024 at a multi-agency public protection meeting, when Cheshire officers raised it. Staffordshire reported the breach the next day.
There is no fine. The regulator said the force’s later improvements had materially reduced the chance of a repeat, and that the infringements were no longer ongoing.
The detail
Two findings matter. First, the regulator decided that putting the victim’s address into the finished notice was neither necessary nor based in law. Officers likely needed the address while drafting the DVPN, to know which property P must stay away from, but nothing in section 25 of the 2010 Act requires it to be printed on the copy handed to the recipient. Home Office guidance does not ask for it either. That made the disclosure unauthorised, even though a DVPN can lawfully be issued without the victim’s consent.
Second, the security finding covers almost six years, from 25 May 2018 until 10 May 2024, when the force finally changed its internal procedure to stop officers including addresses the recipient did not already know. The figures in the reprimand show how thin the safeguards were. At the time of the incident just 34% of officers had completed the force’s DVPN training, including 10% of inspectors and 13% of superintendents. Only 49% of the workforce had completed both core information handling courses. The three people involved in processing this notice had not done data protection training for at least two years, and the authorising officer had not completed any since UK GDPR came in.
The local procedure had also omitted a national training requirement to consult the original risk assessment, the very step that should have flagged the danger.
DVPN training completion has since risen to 51% and data protection course completion to between 68% and 78%, which the regulator welcomed while saying more was needed. Staffordshire has also created strategic and tactical domestic abuse leads, a 12-month domestic abuse chief inspector post and a new risk assessment process. Deputy Chief Constable Caroline Marsh said the force regretted the distress caused and was committed to learning from the case.
Why it matters for UK organisations
This is not a hack, and nobody needed malware to cause the harm. Some of the most dangerous breaches are a single field in a template going to the wrong person. Sally-Anne Poole, the regulator’s head of investigations, put it plainly, saying such breaches are “never just technical failures”. She singled out policing, health and local government, the sectors that routinely hold addresses for people at risk.
The case also lands during a transition. The reprimand notes that from 30 September 2026 the office of the Information Commissioner was abolished under the Data (Use and Access) Act 2025 and its powers passed to a new Information Commission. Most coverage still calls it the ICO, and it still publishes on ico.org.uk. Nothing here suggests its public sector approach has changed: reprimands and enforcement notices remain the norm rather than fines.
That approach faces hard questions. Infosecurity Magazine noted that the regulator warned in 2023 that breaches of domestic abuse victims’ data could put lives at risk, having reprimanded seven organisations in 14 months. Three years on, and weeks after the Metropolitan Police was reprimanded partly for letting a stalking victim’s address reach her stalker, another force is reprimanded for the same kind of harm. Private firms should take no comfort from the absence of a fine: the public sector approach does not apply to them.
Expert view
In my experience, the documents that cause the most damage are rarely the ones anyone thinks of as sensitive. Security teams focus on databases and file shares, while letters, notices and mail-merge templates quietly pull sensitive fields from case systems onto paper that leaves the building. When we test organisations that handle vulnerable people, we look for outputs that disclose more than their purpose needs.
Data minimisation is usually discussed as a principle, but here it is a design decision. If a template has an address field, someone will eventually fill it. Staffordshire’s May 2024 fix was an instruction to officers. That helps, but the stronger control is removing the field from outgoing documents, or flagging confidential addresses so the system refuses to print them.
The training figures are the other lesson. Completion of 13% among superintendents, the rank that authorises DVPNs, and 10% among inspectors suggests training was treated as optional by the people signing off decisions. Boards should track completion for high-risk roles as a governance metric, not leave it to an annual reminder email.
What to do now
- Find your risky outputs. List every template, letter, notice and automated email that draws on records for vulnerable people, and check which personal fields each one actually needs.
- Strip unnecessary fields at source. Remove addresses and contact details from outgoing documents unless the law or the purpose requires them, rather than relying on staff to delete them by hand.
- Mark confidential addresses in your systems. Flag records for people fleeing abuse, and block or warn on any output that would reveal them.
- Add a second check before release. Require a review step for any document going to a third party about a safeguarding case, including confirming redaction and recipients.
- Make training role-specific and measured. Report completion for decision-makers to the board, and chase senior gaps first.
- Tighten access control. The Cyber Essentials user access control requirement, giving people only the access their role needs, applies to case systems too: fewer people able to see protected addresses means fewer chances to leak them.
Bottom line
A notice designed to protect someone instead told their alleged abuser where to find them, because a template carried a field it did not need and the people using it had not been trained. Every organisation holding addresses for people at risk should audit what its documents disclose before its own name appears on a reprimand.
Sources
- Information Commission (ICO): Staffordshire Police reprimand
- Infosecurity Magazine: ICO Reprimands Staffordshire Police After Domestic Abuse Breach
- Local Government Lawyer: Police force unlawfully disclosed home address of domestic abuse victim to alleged abuser, ICO finds
- MLex: UK police force reprimanded for disclosing abuse victim’s address
