Request 101004036313

Under the Freedom of Information (Scotland) Act 2002, please provide the following information relating to data breaches recorded by the council:

1. The total number of data breaches recorded in each of the following financial years:

a) 2021/22
b) 2022/23
c) 2023/24
d) 2024/25
d) 2025/26.

2. Of those data breaches, how many were reported to the Information Commissioner's Office (ICO) in each financial year?

3. Please provide a breakdown of the data breaches by risk rating (e.g. low, medium and high/severe), where such a classification is recorded by the council.

Response 26-08-2026

1. This information is available on the Moray Council website, having previously been provided in response to an FOI request in May 2026 (FOI 101003989643). This information is therefore exempt under section 25 of the Freedom of Information (Scotland) Act 2002 (FOISA), information otherwise accessible. For ease of reference, the link to the relevant webpage is:

   https://www.moray.gov.uk/information-governance-access-to-information-requests/foi-requests-responses/foi-request-number-of-recorded-data-breaches-2020-2025/

2. This information is also available on the Moray Council website, having previously been provided in response to an FOI request in May 2026 (FOI 101003989643).  This information is therefore exempt under section 25 of FOISA, information otherwise accessible. For ease of reference, the link to the relevant webpage is: https://www.moray.gov.uk/information-governance-access-to-information-requests/foi-requests-responses/foi-request-number-of-recorded-data-breaches-2020-2025/

3. Section 17 of FOISA – notice that information is not held – is applicable. Please be advised that data breaches are recorded on the Council’s Data Breach Register, investigated and risk assessed case by case, however no risk rating is applied.