1.
a) The number of data breach incidents the council has had in the last three years (between April 6th - April 5th 2022/23, 2023/24 and 2024/25) Broken down by years.
The Council report on Financial Years, therefore this information is for the period 1st April – 31st March. This information is published as part of our Senior Information Risk Owner (SIRO) report annually.
i. 2022/23: 106
ii. 2023/24: 85
iii. 2024/25: 140
b) Of those, how many were cyber-incidents? (Broken down by years as above).
Zero. This is not to say that the Council haven’t experienced attempts or cyber attacks, but that we have not had a breach as a result of them that compromises the confidentiality, integrity, or availability of information or an information system.
The breaches that the Council has experienced are a result of human error and for the most part are very low risk breaches. We have not directly had a ICO reportable breach in these time periods requested, but have had suppliers/contractors who have been in that position.

2.
a) How many compensation claims have been brought against the council for data breaches in the last three years (between April 6th -April 5th 2022/23, 2023/24 and 2024/25) Broken down by years.
b) Of those, how many were settled with compensation?
c) Of those, how many were refused?
d) How much has the council paid out in compensation for data breach claims in the last three years? Broken down by years as above.
The answers below relate only to those compensation claims notified to the council’s insurance team and insurers.
In 2022/23 no compensation claims arising from alleged data breaches were made against the council.
In 2023/24 a total of 3 compensation claims arising from alleged data breaches were made against the council. 2 of the claims (arising from a single data breach incident) have been settled. The total amount of compensation paid was £4,500. The third claim is currently still open.
In 2024/25 no compensation claims arising from alleged data breaches were made against the council.