What You Need to Know
On 30 June 2026, the Irish Data Protection Commission (“DPC”) published its annual case studies booklet (“Booklet”) alongside its 2025 annual report (“Report”).1
This article is the fourth in our Spotlight on the Report series.2 The Report records that the DPC received 6,521 valid breach notifications in 2025. This was a 16% decrease on 2024 and almost half of these breaches resulting from correspondence being sent to the wrong recipient.3
In this article we examine the DPC’s personal data breaches case studies, which highlight common causes of personal data breaches and the DPC’s approach to such breaches.
Accidental Disclosure by Bank (Case Study 23)
An individual complained to the DPC after receiving another customer’s personal data in the post from their bank. The DPC investigated and the bank confirmed that an accidental disclosure of a third party’s data had occurred (with the complainant as the unintended recipient), but that no breach of the
