ICO reprimands Staffordshire Police: a domestic abuse notice gave the victim's address to the alleged abuser

A training figure 810 days old in a reprimand about training

The ICO's reprimand to Staffordshire Police, dated 13 October 2026, says completion of the force's training on issuing domestic violence protection notices has improved to 51 per cent of officers. The footnote behind that figure cites correspondence from the force dated 25 July 2024. That is 810 days (derived) before the reprimand was signed. On the newest figure the regulator prints, 49 per cent of officers (derived) had still not completed the training on the notice at the centre of this case.

The case itself is set out in the ICO's own words. On 29 March 2024 a Domestic Violence Protection Notice, an emergency notice meant to protect a victim from violence or threats of violence, was served on the alleged abuser after their release from prison. It included the victim's current address, which the alleged abuser did not previously know. The ICO's news release says the notice was meant to protect, and that "its inclusion in the notice was not lawful".

At the time of the disclosure, the reprimand says, just 34 per cent of officers had completed the force's DVPN training: 42 per cent of constables, 10 per cent of inspectors and 13 per cent of superintendents. Superintendent is the rank the law names. Section 24(1) of the Crime and Security Act 2010 says a DVPN may be issued by a member of a police force "not below the rank of superintendent".

This briefing reads the 17 page reprimand in full, the ICO's enforcement page and news release, the two statutes the case turns on, and the Home Office guidance and template for these notices. All were read between 11:18 and 11:40 GMT on Thursday 29 October 2026. Staffordshire Police's own website answered this site's request with HTTP 403, so no statement from the force was read; the force's position below is as the reprimand records it.

What the record does not establish

The 51 per cent figure does not establish what DVPN training completion is today. The reprimand gives no later DVPN figure, and no figure at all for superintendents after the incident. Its newer numbers, from a letter of 14 April 2026, are for two data protection packages, not for the notice. The ICO itself says there "remains room for improvement" in both and recommends the force keep working on them.

It does not establish how many people were affected. Paragraph 29 weighs the risk to "the Data Subject and the other individuals referred to in paragraph 19", and paragraph 19 is blacked out in the published version, along with footnote 15. Who those other individuals are, and how many, is not public.

It does not establish harm as a finding. The ICO's release says the breach "caused serious distress to the victim". The reprimand records the force's own breach form, which said the victim was distressed and might need to move, and records further harms alleged in a civil claim that, it notes, was later discontinued. The abuse itself is described throughout as alleged, and this briefing keeps it that way.

And it does not say why the regulator chose a reprimand over a fine. The reprimand's decision paragraph says a reprimand is "appropriate and proportionate" taking into account the remedial steps. It does not mention the ICO's public sector approach or the word fine. That gap is the subject of a later section.

The two infringements the ICO found

The reprimand finds two breaches of Part 3 of the Data Protection Act 2018, the part that governs police and other competent authorities processing for law enforcement purposes. The first is section 35, the first data protection principle, that processing "must be lawful and fair". The ICO accepts it was "likely necessary" for the force to use the victim's address while preparing the notice, to know which address the alleged abuser was required not to attend. Putting the address into the final notice that was handed over was, in its words, "neither necessary nor 'based on law'", because section 25 of the 2010 Act sets out what a DVPN must contain and the address is not on that list.

The second is section 40, the sixth principle, which requires "appropriate security" using "appropriate technical or organisational measures". The ICO found the force did not have measures that met the high level of security the risk demanded. It gives four reasons: the force's internal DVPN procedures did not include the step in national training of referring to the risk assessments made at the time of the index incident; DVPN training completion was poor; data protection training completion was poor, with 49 per cent of the workforce having completed both packages for the periods 2023/24 and 2024/25; and the three members of staff who processed this notice had not completed data protection training for at least two years, with the authorising officer having completed none since UK GDPR came into force.

The two findings run over very different periods. The lawful processing breach is a single day, 29 March 2024. The security breach runs from 25 May 2018 to 10 May 2024, the day the force changed its procedures: 2,177 days, nearly six years (derived). The ICO dates the security failure to the day the law took effect, not to the day of the disclosure.

Two further points from the reprimand matter to anyone who shares notices across force boundaries. The notice was passed to Cheshire Constabulary to serve, because the alleged abuser had returned to its area. The ICO finds Cheshire "simply acted on the instructions" of Staffordshire and was not a joint controller, so the whole finding sits with the force that wrote the notice. And the reprimand is issued by the Information Commission, which its footnote says took over the powers of the Information Commissioner on 30 September 2026 under the Data (Use and Access) Act 2025. The ICO's own pages still use the name ICO, and so does this briefing.

Zoom

944 days from the served notice to today

The force moved quickly once it knew. The disclosure was raised as a concern at a multi agency public protection conference on 3 April 2024, and the force reported the breach to the ICO the next day, 4 April: one day after becoming aware and six days after the notice was served (both derived). That is inside the 72 hours that section 67 of the 2018 Act sets, where feasible, for a Part 3 controller to notify the regulator. The procedure change followed on 10 May 2024, 42 days after the disclosure (derived).

The regulator was slower. Its notice of intent went out on 20 July 2026, 837 days after the breach report (derived). The force replied on 7 August 2026, 18 days later, and the reprimand is dated 13 October 2026, 922 days after the report (derived). The enforcement page is dated 27 October and the news release 28 October. The reprimand gives no reason for the length of the investigation, and this briefing does not suggest one.

Zoom

The friendly name check: a protection notice, marked restricted

Two comforting labels sat on this document. The first is its name. A Domestic Violence Protection Notice exists to protect a victim, and in this case, as the ICO's Head of Investigations put it in the release, "the very notice designed to protect them instead put them at risk". A protective purpose does not make the content of the document safe. The notice is served on the alleged abuser personally, by law, so everything written on it goes to them.

The second is a marking. The Home Office's template for the notice, Appendix E of its guidance on these orders, is headed "RESTRICTED (when completed)". A protective marking controls who else may see a document. It does nothing about the one person a served notice is written for. The reprimand's training figures carry the same lesson: one of the two data protection packages the force tracks is called Government Security Classification, and before the incident only 49 per cent of the workforce had completed both.

The same template has address slots. Prohibitions two to five each say "[insert address]", to stop the alleged abuser evicting the victim from, entering, staying at or coming near a set of premises. Section 24(8) allows those premises provisions only where the alleged abuser lives in premises also lived in by the person protected. In this case the alleged abuser did not know the address, so on the reprimand's own account they did not live there.

Zoom

The training numbers, and the dates behind them

Every training figure in the reprimand comes from the force's own letters to the ICO, and each has its own date. Read together, they show the authorising rank was the least trained and that the newest DVPN figure is the oldest of the after figures.

The ICO describes the rise from 34 to 51 per cent as "an improvement of 17%". It is 17 percentage points, or a 50 per cent relative rise (derived). The force also told the ICO that a chief superintendent had instructed the staff involved to complete the mandatory courses within two weeks, and that non compliance would go to its Information Assurance Board, chaired by the Deputy Chief Constable.

Zoom

Why a reprimand: what the ICO's own policy says

The ICO's public sector approach, published as policy on 11 November 2025, says it will use warnings, reprimands and enforcement notices for public authorities, "with fines only issued in the most egregious cases". Its first listed example of what may make an infringement egregious is evidence of "a high risk of actual or potential harm to affected people or their family members, including a threat to life following a data breach".

Set that beside the reprimand. The regulator itself writes that the notice exists to protect people from violence, that the risks "required an appropriately high level of security", that the victim had moved several times to escape the alleged abuse, and that the address was "highly sensitive information". Its release quotes its Head of Investigations, Sally-Anne Poole: an error such as "including an address in a document that didn't need it, can expose someone to real and immediate danger".

The reprimand does not walk through the policy's tests. It does not say whether the case was assessed as egregious, and if not, why not. Its stated reasons for a reprimand are the remedial steps: new strategic and tactical Domestic Abuse Leads, a Domestic Abuse Chief Inspector role for 12 months, "enhanced gatekeeper arrangements" that it says lifted the rate of notices converted into orders from 82 to 89 per cent, training commitments, and enhanced video response for victims. It concludes the infringements are "no longer ongoing".

Infosecurity Magazine's report, the lead for this briefing, calls this a case that will do little to allay concerns that the public sector approach is not working. That is the publication's view, not a finding. This site read a similar gap in the ICO's September 2026 action against the Met over a retail crime platform: the Met Auror notice briefing. The ICO's site also lists a follow up audit of Staffordshire Police, dated 18 December 2025 and carried out with the force's consent. That page gives no findings, and the reprimand does not mention it.

The UK law and guidance behind it

This is a UK case under UK law, and the rules it turns on apply to every police force in England and Wales and to any competent authority processing for law enforcement purposes.

Two forward points. Legislation.gov.uk lists the omission of sections 24 to 33 of the 2010 Act by section 55(1) of the Domestic Abuse Act 2021 as a change not yet applied to the text it shows as up to date on 29 October 2026. Whatever notice replaces the DVPN will come with its own forms, and the lesson about address fields applies to them too. And the Home Office's guidance page still carries the template marked "Rev 06/11", with the address slots above.

Technical details

There is no malware, exploit or indicator in this case. The artifacts that matter are the legal list of what a notice must contain, the template fields that can carry an address, and the procedure change the force made. Each is copied exactly from the primary that published it. A force or any body that serves documents on a person who may pose a risk can compare its own forms with them.

First, the statutory contents of a DVPN. This is the whole of what section 25 requires on the face of the notice. A form that asks for more than this needs a reason for each extra field.

25 Contents and service of a domestic violence protection notice
(1) A DVPN must state
(a) the grounds on which it has been issued,
(b) that a constable may arrest P without warrant if the constable has reasonable grounds for believing that P is in breach of the DVPN,
(c) that an application for a domestic violence protection order under section 27 will be heard within 48 hours of the time of service of the DVPN and a notice of the hearing will be given to P,
(d) that the DVPN continues in effect until that application has been determined, and
(e) the provision that a magistrates' court may include in a domestic violence protection order.
(2) A DVPN must be in writing and must be served on P personally by a constable.

Second, the template fields that hold an address. These are the slots to audit in any local version of the form: each one should be filled only where section 24(8) applies, that is, where the alleged abuser shares the premises.

RESTRICTED (when completed)
NOTICE (insert name, date of birth and address of the individual on whom this notice is served)
2. To prohibit [insert name of alleged perpetrator] from evicting or excluding from [insert address]
[insert name of associated person to be protected].
3. To prohibit [insert name of alleged perpetrator] from entering [insert address].
4. To require [insert name of alleged perpetrator] to leave [insert address].
5. To prohibit [insert name of alleged perpetrator] from coming within [specify distance] of
[insert address].

Third, the control the force added. This is the rule as the ICO records it; the force's internal procedure document itself is not public.

On 10 May 2024, Staffordshire Police updated its internal procedures
for superintendents, inspectors and investigating officers to make
specific provision that authorising officers do not include address
information in DVPNs where such information was not previously
known to the recipient.

Fourth, the training commitments the force made in its representations, which a body in the same position can lift into its own course outline.

"future training and communications will continue to emphasise" the
"risks associated with inappropriate disclosure of victim information",
the "potentially serious impact such disclosure can have on victim
confidence and safety", the "importance of supervisory assurance and
review prior to service of protective notices" and the "need to ensure
victim details are not inadvertently disclosed during safeguarding
processes"

What a force, or any body holding domestic abuse data, should do, in order

The first five items follow the ICO's own advice in its release, in its words where they are quoted. The rest come from the reprimand's findings. They apply beyond policing: the ICO's release names health and local government too.

The question that exposes the gap

The reprimand closes the case on the basis that the risk has been "sufficiently reduced". Its newest evidence for the training on these notices is a letter from July 2024, and it gives no figure at all for the superintendents who authorise them. So the question for Staffordshire Police, and for the ICO, is this: what percentage of the force's superintendents have completed the DVPN training today, and if the regulator did not ask before closing the case, what was its view that the infringement is no longer ongoing based on?

Key facts