Is it a data breach if a colleague reads your files?

MacWindowsUpdated

Under UK data protection law, a personal data breach includes unauthorised access to personal data, and the ICO says that covers deliberate as well as accidental causes. Separately, section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain personal data without the controller's consent.

This page is general information, not legal advice. For a real case, speak to a solicitor.

Quick answer

The ICO defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." Its list of examples includes "access by an unauthorised third party". Whether the organisation must report it depends on the risk to people. Obtaining personal data without the controller's consent can also be an offence under section 170.

What counts as a personal data breach?

The definition is in Article 4(12) of the UK GDPR, and the ICO's guide gives it as: "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data."

The ICO adds that this "includes breaches that are the result of both accidental and deliberate causes. It also means that a breach is more than just about losing personal data."

Does unauthorised access by someone inside the organisation count?

The ICO's guide lists examples. Personal data breaches can include:

  • "access by an unauthorised third party";
  • "deliberate or accidental action (or inaction) by a controller or processor";
  • "sending personal data to an incorrect recipient";
  • "computing devices containing personal data being lost or stolen";
  • "alteration of personal data without permission"; and
  • "loss of availability of personal data".

It then sums it up: "there will be a personal data breach whenever any personal data is accidentally lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable and this unavailability has a significant negative effect on individuals."

The phrase that matters here is "if someone accesses the data or passes it on without proper authorisation". That sentence says "someone", without limiting it to people outside the organisation.

Who has to report it, and when?

The duty sits with the organisation, not with you. The ICO says: "When a personal data breach has occurred, you need to establish the likelihood of the risk to people's rights and freedoms. If a risk is likely, you must notify the ICO; if a risk is unlikely, you don't have to report it."

On timing, the ICO says organisations must report a notifiable breach "without undue delay, but not later than 72 hours after becoming aware of it."

If the breach is likely to result in a high risk to people, the ICO says "you must inform those concerned directly and without undue delay." And whether or not a breach is reported, organisations "must also keep a record of any personal data breaches".

The ICO's checklist for organisations includes staff knowing "how to escalate a security incident to the appropriate person or team", so if you think someone has read personal data they shouldn't have, ask who that is where you work. Reporting snooping at work explains the routes.

When does it become an offence?

The breach rules above are duties on the organisation. Section 170 is different: it is an offence by a person. Section 170(1) of the Data Protection Act 2018 makes it an offence for a person "knowingly or recklessly":

  1. "to obtain or disclose personal data without the consent of the controller";
  2. "to procure the disclosure of personal data to another person without the consent of the controller"; or
  3. "after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained."

Section 170 also sets out defences, such as that the obtaining was necessary to prevent, investigate or detect crime, or was justified in the public interest in the particular circumstances. Selling, or offering to sell, data obtained that way are separate offences under sections 170(4) and (5). Under section 196, the penalty is a fine.

Where the access involved making a computer perform a function, the Computer Misuse Act 1990 may also be relevant. The CPS guidance on that Act says that in certain circumstances, consideration should be given to the Data Protection Act 2018. Our UK law guide covers both.

What have the courts done in recent cases?

The ICO publishes its prosecutions. Two examples, in the ICO's own account:

  • Qonain Hussain, 8 October 2025. A former insurance claims advisor accessed 1,550 customer records in 2020. He was required to access customer records when handling claims, but the ICO says "a large portion" were accessed outside his scheduled working hours or while he was on annual leave. He pleaded guilty to one offence under section 170(1) and was fined £1,500.
  • Debbie Okparavero and Maliha Islam, 29 May 2026. The two former RAC employees had pleaded guilty to a conspiracy to commit offences under section 1 of the Computer Misuse Act 1990 and the Data Protection Act 2018, for unlawfully copying and selling almost 30,000 lines of personal information. Each received a six-month suspended sentence in October 2024. In 2025 and 2026 the courts made confiscation orders totalling £118,852.32.

Each case turns on its own facts. A recent Computer Misuse Act case is in our UK law guide.

What about outside the UK?

In the EU, the GDPR uses the same definition of a personal data breach, in Article 4(12).

More questions

Is it a data breach if a colleague looks at my personal file?

The ICO says there is a personal data breach "if someone accesses the data or passes it on without proper authorisation." Whether that happened in a particular case is for the organisation to assess. For a real case, speak to a solicitor.

Does every breach have to be reported to the ICO?

No. The ICO says an organisation must notify it if a risk to people's rights and freedoms is likely, and doesn't have to if a risk is unlikely. It must still keep a record of every personal data breach and be able to justify not reporting.

Do I have to report it to the ICO?

The ICO says the UK GDPR puts "a duty on all organisations to report certain personal data breaches", so notifying is the organisation's job. If you're concerned about how your employer handled your data, our guide on reporting snooping at work covers HR, IT, the police and the ICO.

Is section 170 the same as the Computer Misuse Act?

No. Section 170 is about obtaining, disclosing, procuring or retaining personal data without the controller's consent, "knowingly or recklessly". Section 1 of the Computer Misuse Act is about causing a computer to perform a function to secure access that the person knows is unauthorised.

What is the penalty under section 170?

Section 196 of the Data Protection Act 2018 says a person who commits a section 170 offence is liable to a fine. The court can also order a document or other material connected with the offence to be forfeited, destroyed or erased.

Sources