ICO reprimand: a formal notice still needs a disclosure check
The ICO’s Staffordshire Police reprimand concerns an address disclosed in a protection notice. Check each outgoing document’s contents as well as its recipient.
The brief
The ICO announced action against Staffordshire Police after a domestic abuse victim’s address was disclosed to their alleged abuser in a Domestic Violence Protection Notice. The reprimand is dated 13 October; the website record is dated 27 October and the announcement followed on 28 October. Enforcement summary; ICO announcement.
Our analysis distinguishes delivery from disclosure. A person may need to receive a notice without needing every detail stored in the underlying case file. Before sending, review the actual outgoing version and the information it contains. Keep the reason for including sensitive fields clear, along with the person responsible for approval. A correct delivery address cannot establish that the document’s contents were appropriate for that recipient.
The full record
The ICO said the incident occurred in March 2024 and involved an address previously unknown to the alleged abuser. It described serious distress and weaknesses in training, and reported changes to the force’s procedures. The action is a reprimand, not a fine. ICO announcement; enforcement record.
The reprimand distinguishes information needed to prepare the notice from information needed in the notice served. It finds infringements of sections 35 and 40 of the Data Protection Act 2018 in law-enforcement processing. It also acknowledges remedial measures and concludes the infringements were no longer ongoing. Reprimand, paragraphs 23–24 and 35–36.
Our analysis: review the outgoing version
A workflow can deliver the intended notice to the intended person while disclosing information that should have remained elsewhere. That makes document content an approval question of its own. The final check should examine the version being sent, including attachments, rather than a general statement that the case file is complete.
For a hypothetical professional notice, list the fields the recipient needs for the stated purpose. Have the responsible person establish the applicable legal requirements. Identify sensitive information that has entered the template from another part of the file. Decide explicitly whether it belongs in the outgoing document.
Separate the case file from the recipient’s copy
The internal record and the communication serve different purposes. Keep a controlled record of the material considered, while producing a recipient-specific copy containing what is appropriate to disclose. Where redaction is needed, check the finished output rather than assuming that selecting a redaction command achieved the intended result.
Retain the version approved and the version sent, with enough information to establish whether they matched. A later reviewer should not have to infer the content of the outgoing notice from the current template, which may have changed.
Test the boundary with fictional data
Use a fictional notice generated from a case file containing an address that the intended recipient should not receive. Ask a reviewer to inspect the output and explain what belongs in it. Test the attachments too. A successful exercise should identify the inappropriate field before delivery and make the approval decision recoverable.
This proposed test measures a particular disclosure boundary. It is not a legal checklist for every notice or a benchmark already carried out. The practical conclusion is narrower: confirm both who receives the communication and what that person will learn from its actual contents.
Read the full 17-page public reprimand, dated 13 October 2026, alongside the website enforcement record dated 27 October and the announcement dated 28 October. The disclosure occurred on 29 March 2024. Findings under Part 3 of the Data Protection Act 2018 are attributed to the ICO; this is not a statement that the same legal framework governs all readers. The examples are editorial analysis using fictional data.