Staffordshire Police data breach: your rights if your address is disclosed without your permission

An address disclosure can put someone’s safety at risk. The ICO’s action against Staffordshire Police highlights organisations’ confidentiality/data protection duties.

What happened at Staffordshire Police?

In its 28 October 2026 announcement, the ICO reported that Staffordshire Police disclosed a domestic abuse victim’s address to their alleged abuser in a protection notice. The recipient did not previously know the address. The ICO identified inadequate safeguards, including training shortcomings and issued a reprimand.

Sally-Anne Poole, Head of Investigations at the ICO, said: “Data breaches of this kind are never just technical failures”. Including an unnecessary address “can expose someone to real and immediate danger”.

Must organisations keep your address confidential?

An address identifying you is personal data. Most organisations must comply with the UK GDPR and Data Protection Act 2018, which requires an organisation to use information lawfully and fairly, retain/share only what is necessary and protect it against unauthorised disclosure. Article 32 of the UK GDPR requires security appropriate to the risk, including staff procedures, not just IT protection.

Sharing without consent is not automatically unlawful. Another legal basis, such as a legal obligation, may permit disclosure. Police processing for law enforcement falls under Part 3 of the Data Protection Act 2018, rather than the general UK GDPR regime. It must still meet lawfulness, fairness and security requirements. An important purpose does not excuse unnecessary disclosure.

What if disclosure could put someone at risk?

Known danger demands safeguards reflecting that risk. An address is not automatically “special category data”, but revealing a safe location can have serious consequences. Appropriate measures may include confidentiality warnings, restricted access, effective redaction, recipient checks, staff training and safe contact arrangements. A data protection impact assessment may be required before processing likely to create high risks. See the ICO’s data-sharing security guidance for further information.

Under the UK GDPR, breaches generally require ICO notification within 72 hours of awareness unless the breach is unlikely to risk people’s rights and freedoms. High-risk breaches generally require affected individuals to be told without undue delay, subject to some exceptions.

What should you do if your address has been disclosed?

Prioritise safety. If you are in immediate danger, call 999. Domestic abuse support is available. Tell the organisation how it can contact you safely.

1. Request urgent action: ask the data protection officer what was disclosed, to whom and how further disclosure will be prevented.
2. Preserve evidence securely: keep correspondence and records of distress, disruption and resulting expenses.
3. Complain: raise concerns with the organisation, then consider the ICO’s complaints service if unresolved.
4. Seek legal advice: remedies may include compensation, correction or restriction of records and urgent court action against further disclosure. Rights and remedies depend on the circumstances. It is important to note that it is unlikely to be cost effective to pursue court proceedings in respect of an individual data breach, unless there has been significant damage caused as a result.

Can you claim data breach compensation for distress?

Financial loss is not essential: compensation may cover distress under Article 82 UK GDPR and section 169 of the Data Protection Act 2018. However, a breach alone does not guarantee payment: the legal infringement, compensable harm and connection between them must be established, subject to applicable defences. It is important to note that, unless there have been additional financial costs associated with the data breach (i.e. in the case involving Staffordshire Police the victim may have had to incur significant costs relocating), a claim for a single data breach is unlikely to be justified when compared to the legal fees of pursuing such a claim.

The ICO cannot award compensation; payment is agreed with the organisation or decided by a court. Seek advice promptly about evidence, deadlines and costs. An ICO complaint does not normally stop court time limits running.

Speak to Nelsons about a data breach claim

If your address or other private information has been disclosed, Nelsons can help you understand your options. Enquire through Nelsons’ data breach solicitors details.

General information, not individual legal advice. Remedies discussed relate to England and Wales only.