ICO Reprimands Staffordshire Police Over DVPN Address Disclosure

ICO Reprimands Staffordshire Police for Disclosing a Domestic Abuse Victim's Address in a DVPN

The UK data protection regulator, which became the Information Commission on 30 September 2026 but still trades as the ICO, has reprimanded Staffordshire Police after the force included a domestic abuse victim's home address inside a Domestic Violence Protection Notice that was then served on the alleged abuser. No fine was imposed.

Information last verified on 29 October 2026. This is a developing story; we update it as the record changes.

Status: The reprimand is dated 13 October 2026 and the regulator's enforcement register carries the entry under the date 27 October 2026. It is a reprimand only: no monetary penalty, no enforcement notice and no order to take any step. Section 162 of the Data Protection Act 2018 lists the notices that may be appealed to the Tribunal and a reprimand is not among them.

Jurisdiction scope: This article addresses a reprimand issued to an England and Wales police force. The data protection duties described sit in Part 3 of the Data Protection Act 2018, which extends to the whole of the United Kingdom; the DVPN scheme described sits in the Crime and Security Act 2010 and extends to England and Wales only. It does not address Scotland's or Northern Ireland's separate protective order regimes. For the wider framework, see our UK data privacy and records coverage.

What Happened

The Information Commission issued the Chief Constable of Staffordshire Police with a reprimand on 13 October 2026 concerning infringements of sections 35 and 40 of the Data Protection Act 2018. The regulator's enforcement register carries the entry under the date 27 October 2026, two weeks after the document's own date, and classifies it under Reprimands in the criminal justice sector. The public summary reads:

"Staffordshire Police has been issued with a Reprimand, after the force unlawfully disclosed a domestic abuse victim's home address to their alleged abuser, within a Domestic Violence Protection Notice ("DVPN")." Source: ICO enforcement register (Information Commission), entry for Staffordshire Police, dated 27 October 2026

The sequence set out in the reprimand is narrow and documented. On 3 February 2024, while the person later made subject to the notice (identified in the document only as P) was in prison, the data subject reported to Staffordshire Police that P had committed a communications offence. P was released on or around 26 March 2024. The following day, 27 March 2024, an authorising officer approved the issue of a DVPN against P with a view to protecting the data subject. The notice as drafted included the data subject's address, which the reprimand records P was not previously aware of (paragraph 10).

Because P had returned to a different force area, the notice was passed to Cheshire Constabulary to serve. Cheshire officers served it on P on 29 March 2024, which is the date the address reached P (paragraph 11). Staffordshire Police did not learn of the problem until 3 April 2024, when P was discussed at a Multi-Agency Public Protection Arrangements conference attended by Cheshire Police and the disclosure was raised as a concern. The force reported the breach to the regulator the next day, 4 April 2024 (paragraph 17).

The regulator fixed two infringement periods. The lawfulness infringement was a single day, 29 March 2024, the date of service. The security infringement ran from 25 May 2018, when the force's obligations under the 2018 Act took effect, to 10 May 2024, the date Staffordshire Police amended its internal DVPN procedures to state that authorising officers must not include address information the recipient did not already know (paragraph 16).

Staffordshire Police is the controller. It is a competent authority under section 30(1)(a) of and Schedule 7 to the Data Protection Act 2018, so Part 3 of that Act applies to its law enforcement processing by virtue of section 29. The regulator expressly found that Cheshire Constabulary was not a joint controller: it acted on Staffordshire's instructions and exercised no decision making power over the content of the notice (paragraphs 13 to 15).

The procedural history is also on the record. The regulator sent a Notice of Intent on 20 July 2026. Staffordshire Police made written representations on 7 August 2026 which did not dispute the provisional findings, and instead set out further improvements (paragraphs 4 and 33). The reprimand was signed by a Group Manager exercising delegated authority on behalf of the Information Commission.

The harm the document records

The regulator was careful about how it characterised the data. The category affected was basic personal identifiers, and the address was not special category data. But the reprimand records that the investigation brought to light allegations that P had subjected the data subject to physical and emotional abuse over several years, and that the data subject had relocated on numerous occasions to escape it. On that basis the regulator concluded that the current address "was highly sensitive information and should have been handled as such" (paragraph 18).

The force's own breach report of 4 April 2024 recorded that the data subject was distressed on learning of the disclosure and that there was a suggestion they might need to move house. The data subject later brought a civil claim against the force for misuse of private information, which the reprimand notes was subsequently discontinued (paragraph 29(d) and footnote 23). Paragraph 19 of the document appears blank in the published non-confidential version, and later paragraphs refer to other affected individuals described there, so some detail has been withheld from publication. We are not naming or further describing anyone involved, and nothing below should be read as a conclusion about what happened to the person afterwards.

A Reprimand Is the Bottom Rung, Not a Penalty

This matters for reading the story accurately, because a reprimand looks like punishment and is not.

The regulator's corrective powers for law enforcement processing are listed in Schedule 13, paragraph 2 of the Data Protection Act 2018. The schedule describes them as investigative, corrective, authorisation and advisory powers: notifying a controller or processor of an alleged infringement, issuing warnings that intended processing is likely to infringe, issuing reprimands where processing operations have already infringed Part 3 or Part 4, and issuing opinions to Parliament, the government, other bodies and the public. Only the reprimand in paragraph 2(c) responds to an infringement that has already happened, and it is the lightest of the measures the regulator can reach for once it has made a finding. A reprimand is a published statement that the law was broken. It carries no financial consequence, imposes no obligation and compels no change. The regulator may follow it with an enforcement notice or a penalty notice, but it did not do so here.

Nor is a reprimand appealable. Section 162(1) of the 2018 Act gives a right of appeal to the Tribunal against an information notice, an assessment notice, an interview notice, an enforcement notice, a penalty notice and a penalty variation notice. A reprimand is absent from that list, so the force has no statutory route to challenge the findings and, equally, no process in which they would be tested.

The reason this outcome is so common for British public bodies is a published policy. The regulator's public sector approach, published on 11 November 2025, states that when it exercises its discretion on fining public authorities it "will use our wider powers, including warnings, reprimands and enforcement notices, with fines only issued in the most egregious cases, that is where the infringements are especially serious." The regulator's stated reason, set out when it confirmed the approach in December 2024, is so that victims of a data breach are not punished twice in the form of reduced budgets for vital public services. Scope is set by the meaning of public authority in section 7 of the Data Protection Act 2018, which routes to the Freedom of Information Act 2000 definition, and Schedule 1 to that Act lists a chief officer of police of a police force in England or Wales. The reprimand itself does not cite the policy, so we are describing the published framework rather than the reasoning in this document.

What the Law Actually Says

Part 3 governs police data, not the UK GDPR

Most privacy news in the UK turns on the UK GDPR. This one does not. When a competent authority processes personal data for the law enforcement purposes defined in section 31, Part 3 of the Data Protection Act 2018 applies instead, with its own six data protection principles in Chapter 2. Part 3 defines controller itself, at section 32, as the competent authority that determines the purposes and means of the processing. The reprimand reached the same result by a different route, treating Staffordshire Police as a controller within the Article 4(7) UK GDPR definition, which its footnote 10 applies to law enforcement processing through section 6(1) of the 2018 Act. If you are mapping this against the general regime, our explainer on the UK GDPR, the Data Protection Act 2018 and the DUAA changes sets out how the two sit alongside each other.

Section 35(1) is the first principle:

"The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair." Source: Data Protection Act 2018, s.35(1)

Section 35(2) adds that such processing is lawful only if and to the extent that it is based on law and either the data subject has consented or the processing is necessary for the performance of a task carried out for that purpose by a competent authority. No consent was obtained, so the regulator assessed necessity. Its conclusion is the heart of the decision:

"the processing of this address information by way of its inclusion in the final DVPN document which was disclosed was neither necessary nor 'based on law', as there is no requirement in section 25 of the CSA, which sets out the requirements for the contents and service of a DVPN, to include this information in a DVPN." Source: Reprimand to the Chief Constable of Staffordshire Police, 13 October 2026, paragraph 23

The regulator accepted that the force probably needed to process the address internally in order to draft the notice, so that P could be told which premises to stay away from. The infringement was putting it in the document that was handed over.

Section 40 is the sixth principle, and it is short:

"The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, 'appropriate security' includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage)." Source: Data Protection Act 2018, s.40

Section 40 is where the training findings landed. The regulator held that a high level of security was appropriate to this risk and that the force's measures did not meet it, citing four things: internal DVPN procedures that omitted the national training requirement to refer back to risk assessments made at the time of the index incident; DVPN training completed by only 34% of officers at the time, broken down as 42% of constables, 10% of inspectors and 13% of superintendents; general data protection training completed in full by only 49% of the workforce across 2023 to 2025; and the fact that the three staff who handled this notice had not completed data protection training for at least two years, with the authorising officer never having completed any since the UK GDPR took effect (paragraph 31).

Against that, the regulator recorded the remediation: the May 2024 procedure change, DVPN training completion up to 51%, data protection completion up to 68% and 78% across the two packages, new strategic and tactical Domestic Abuse Leads, a Domestic Abuse Chief Inspector post for twelve months, enhanced gatekeeper arrangements that lifted the DVPN to DVPO conversion rate from 82% to 89%, and investment in enhanced video response for victims (paragraphs 32 and 34). It concluded that the infringements were no longer ongoing and that a reprimand was appropriate and proportionate.

The version of the law being described

The Data (Use and Access) Act 2025 has been commencing in stages through 2025 and 2026, so the version matters. Section 35 was amended on 20 August 2025, but only in subsection (6)(b) and subsection (8); subsections (1) and (2), the provisions relied on here, are unchanged since 25 May 2018. Section 40 has not been amended at all. Schedule 13, paragraph 2 is substantively unchanged: the only alteration, on 30 September 2026, replaced the word Commissioner with Commission.

The DVPN Form Was the Mechanism

A DVPN is an emergency, police-issued notice, and the statutory scheme is tight. Under section 24(1) of the Crime and Security Act 2010, only a member of a police force of at least superintendent rank may issue one. Section 24(2) permits it against a person aged 18 or over where the authorising officer has reasonable grounds for believing that the person has been violent or has threatened violence towards an associated person and that the notice is necessary to protect that person. Section 24(5) is explicit that a notice may be issued even where the person it protects does not consent, and the Home Office guidance repeats at paragraph 5.1.3 that a DVPN or DVPO "does not require the consent of the victim", noting that coercive and controlling behaviour may be affecting the protected person's own decision making.

Section 25 then sets out what the notice must contain. A DVPN must state the grounds on which it was issued, that a constable may arrest without warrant for breach, that a magistrates' court will hear a DVPO application within 48 hours of service, that the notice continues until that application is determined, and what provision the court may include in an order. It must be in writing and served on the recipient personally by a constable. The protected person's address is nowhere on that list, which is precisely the gap the regulator relied on.

The Home Office guidance, last updated on 8 November 2022, also says a DASH risk assessment, or equivalent, should form part of the material put before the superintendent when approval for a DVPN is sought (paragraph 5.1.5). The reprimand treated the omission of that cross-reference from the force's internal procedures as part of the security failure.

Are DVPNs Being Replaced?

Partly, and slowly. Part 3 of the Domestic Abuse Act 2021 creates Domestic Abuse Protection Notices and Domestic Abuse Protection Orders, which are broader than DVPNs: a notice under section 22 can be given by an officer of inspector rank or above, covers abusive behaviour rather than violence alone, protects people aged 16 or over who are personally connected to the recipient, and has effect throughout the United Kingdom.

It is not yet the general law. The powers to give a notice or make an order have only ever been commenced on a piloted basis, in specified areas and for specified periods (a set of ancillary provisions on breach, appeals and interpretation was commenced across the whole of England and Wales by the same instrument): Greater Manchester and the London boroughs of Bromley, Croydon and Sutton from 27 November 2024; the Cleveland districts of Hartlepool, Middlesbrough, Redcar and Cleveland and Stockton-on-Tees from 11 March 2025; and six North Wales authorities from 28 April 2025. Those periods were due to end on 31 March 2026 and were extended to 24 November 2026 by regulations made on 24 March 2026. Staffordshire is not among the piloted areas, and the incident in this case predates the first pilot by eight months in any event.

Critically, section 55 of the Domestic Abuse Act 2021, which would omit sections 24 to 33 of the Crime and Security Act 2010 and so abolish DVPNs and DVPOs, is still marked prospective on the statute book. It has never been commenced, including in the pilot areas. So DVPNs remain live law across England and Wales. If you need the current position area by area, we track the DAPO pilot areas and status by nation.

The Regulator Changed in Law, Not in Branding

Anyone citing this document needs the name right. On 30 September 2026, the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015, brought into force sections 117(4)(a), 118 and 119 of that Act. Section 118 abolished the office of the Information Commissioner. Section 119 transferred the Commissioner's functions to a new body, the Information Commission, and provides that references to the Information Commissioner in any enactment or document are to be read as references to the Information Commission. A separate instrument, SI 2026/386, substituted the word Commission throughout the relevant provisions of the Data Protection Act 2018, including Schedule 13 and section 165.

The reprimand reflects that change precisely. It is headed as an exercise of the corrective powers of the Information Commission, refers throughout to the Commission's findings, and carries a footnote explaining that references to the Information Commission in relation to events before 30 September 2026 should be read as references to the Information Commissioner.

The public branding has not followed. The enforcement register page is headed ICO, the website still carries the ICO tagline, and the reprimand itself describes the force's correspondence as having been sent to the ICO. In practical terms the regulator remains the ICO; in law its decisions since 30 September 2026 are the Information Commission's. Both are correct, and it is worth saying which you mean.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The striking feature of this document is where the failure sits. There is no rogue officer in it. An authorising officer approved a notice intended to protect someone, using a force template, and the template had nothing in it that stopped the protected person's address travelling to the person it was protecting them from. The fix the force made on 10 May 2024 was a single added stipulation in an internal procedure: that authorising officers do not include address information the recipient did not already know. On the regulator's own account, the three members of staff who handled the notice had not completed data protection training in at least two years, and one of them had not completed any at all since the UK GDPR came into force. Measured against section 40, which asks for security appropriate to the risk, the gap the regulator identified is organisational rather than individual.

That makes the case a useful test of what Part 3 asks of forces. The first principle in section 35 is not satisfied by a legitimate purpose. The regulator accepted that issuing the notice was a protective act and that the address was properly processed to prepare it; the infringement was including a field the statute never asked for in the document that left the building. Data minimisation in a law enforcement context often reduces to exactly this question: what must appear on the form that the subject of the notice is handed.

There is an open tension on the record that the document does not resolve. The published public sector approach reserves fines for the most egregious cases, and its own illustrative factors for egregiousness include a high risk of actual or potential harm, expressly including a threat to life following a data breach, and a high degree of negligence. The reprimand records a protected person's address reaching an alleged abuser, distress, a possible need to move home and a discontinued civil claim alleging serious psychiatric harm, alongside training completion rates the regulator itself described as poor. It does not explain why those features were not treated as egregious. What it does say is that the remedial steps taken had sufficiently reduced the risk of recurrence, and that a reprimand was appropriate and proportionate in all the circumstances. Readers can hold both of those points; we are not going to guess at the reasoning that was not published.

The procedural asymmetry is worth naming too. A reprimand is published, carries reputational weight, and is final in the sense that nothing in section 162 lets the recipient test it before the Tribunal. It is also final in the opposite direction: nothing obliges the force to do anything further, and the regulator's leverage after publication is persuasion. In this case the regulator recorded that it "recommends" continued improvement in training completion rates. A recommendation is what the lowest rung of the ladder can carry.

How a Data Subject Complains About a Police Force

There are two separate systems, and people routinely send a complaint into the wrong one. The general information below is not advice about any individual case.

The data protection route. Section 165(2) of the Data Protection Act 2018 lets a data subject complain to the Information Commission where they consider that, in connection with their personal data, there is an infringement of the UK GDPR or Part 3 or Part 4 of the Act. Police handling of law enforcement data falls squarely in Part 3. Since 19 June 2026 the controller carries complaint duties of its own: section 164A, inserted by the Data (Use and Access) Act 2025, requires a controller to facilitate complaints, to acknowledge receipt within 30 days and to respond without undue delay. The regulator's own complaint process asks for a copy of the complaint you made to the organisation, so in practice the force comes first. The regulator states that complaints needing detailed examination are currently being assigned to case officers around ten months after submission, and that it cannot award compensation. If the regulator fails to respond appropriately, or fails to update you on progress or outcome within three months, section 166 lets you apply to the Tribunal for an order requiring it to progress the complaint. Our step-by-step guide to complaining to the ICO sets out the sequence.

The police conduct route. A complaint about the conduct of officers or the service a force provided goes into the police complaints system, which the Independent Office for Police Conduct oversees in England and Wales. Forces handle most complaints themselves, usually through a professional standards department, and the IOPC states that by law a force must have the opportunity to investigate, explain, apologise or put things right first; a complaint submitted on the IOPC form is passed to the force or local policing body. For complaints made on or after 1 February 2020 there is a right of review if you are unhappy with the handling or the outcome. The outcome letter names the relevant review body, which may be the IOPC or the local policing body such as a police and crime commissioner, and an application must be made within 28 calendar days, counted from the day after the date on that letter. The IOPC also notes it cannot direct compensation.

Compensation. Neither the regulator nor the IOPC can award money. For a contravention of the data protection legislation other than the UK GDPR, which includes Part 3, section 169 of the Data Protection Act 2018 gives a person who suffers damage a right to compensation from the controller, and defines damage to include non-financial damage such as distress. That is a court claim, subject to the controller's defence that it is not in any way responsible for the event. We cover data breach compensation in the UK separately.

This is general legal information, not legal advice. It covers England and Wales for the DVPN scheme and the United Kingdom for the data protection duties described, and reflects sources verified on 29 October 2026. Laws change and this story is developing; consult a solicitor qualified in your jurisdiction about your specific situation.

Related articles

• UK Data Privacy, DBS Checks and Your Rights
• Domestic Abuse Protection Order (DAPO) UK: pilot areas and current status
• How to complain to the ICO, step by step
• UK GDPR explained, with the Data Protection Act 2018 and DUAA changes

---

Last updated: 2026-10-29. This is a developing story; details verified as of 2026-10-29.

Frequently Asked Questions

Was Staffordshire Police fined over the DVPN disclosure?

No. The regulator issued a reprimand under Schedule 13, paragraph 2(c) of the Data Protection Act 2018. A reprimand is a published finding that the law was infringed. It carries no fine, no enforcement notice and no obligation to take any action.

Why do UK public bodies get reprimands instead of fines?

Because of the regulator's published public sector approach, issued on 11 November 2025, under which it uses warnings, reprimands and enforcement notices for public authorities and issues fines only in the most egregious cases where the infringements are especially serious. The stated reason is that fining a public body reduces the funding available for its services. Scope is set by the definition of public authority in section 7 of the Data Protection Act 2018.

Which law did Staffordshire Police breach?

Sections 35 and 40 of the Data Protection Act 2018, the first and sixth data protection principles for law enforcement processing in Part 3 of that Act. Section 35 requires processing to be lawful and fair; section 40 requires appropriate security. The UK GDPR was not the basis of the findings. The reprimand reasoned controller status at paragraph 14 through the Article 4(7) UK GDPR definition, which its footnote 10 applies to law enforcement processing via section 6(1) of the Act; Part 3 also carries its own definition of controller at section 32.

Does a DVPN have to include the protected person's address?

No. Section 25 of the Crime and Security Act 2010 lists what a DVPN must state, and the protected person's address is not on that list. The regulator relied on exactly this point in finding that including the address was neither necessary nor based on law.

Have Domestic Abuse Protection Notices replaced DVPNs?

Not yet, and not generally. Part 3 of the Domestic Abuse Act 2021 has been commenced only in specified pilot areas for specified periods, currently running to 24 November 2026. Section 55 of that Act, which would repeal sections 24 to 33 of the Crime and Security Act 2010, remains prospective and has never been brought into force, so DVPNs are still law across England and Wales.

Is the regulator now called the Information Commission or the ICO?

Both, in different senses. Sections 118 and 119 of the Data (Use and Access) Act 2025, commenced on 30 September 2026 by SI 2026/1015, abolished the office of the Information Commissioner and transferred its functions to a new Information Commission. The reprimand is issued in the Commission's name. The organisation still presents itself publicly as the ICO, and its website and enforcement register use that name.

Can the regulator order a police force to pay compensation?

No. The regulator states it cannot award compensation even where it concludes an organisation has broken data protection law. For a Part 3 contravention, section 169 of the Data Protection Act 2018 gives a right to claim compensation from the controller in court, and damage there includes non-financial damage such as distress.

Can a reprimand be appealed?

There is no statutory right of appeal. Section 162(1) of the Data Protection Act 2018 lists the notices a recipient may appeal to the Tribunal, namely an information notice, an assessment notice, an interview notice, an enforcement notice, a penalty notice and a penalty variation notice. A reprimand is not included.