- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Department for Work and Pensions – Reprimand (United Kingdom, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Department for Work and Pensions was reprimanded for improperly disclosing personal data due to a failure in testing a new application. This is important because it shows how critical it is to assess new tools before using them to protect people's information.
What happened
DWP disclosed personal data of 16 individuals after implementing a new application without proper testing for its specific use.
Who was affected
Sixteen individuals whose personal data was disclosed were affected by this incident.
What the authority found
The Information Commissioner's Office reprimanded DWP for not conducting necessary testing and assessments before using the application, leading to data breaches.
Why this matters
This reprimand highlights the importance of conducting thorough testing and assessments for new data handling tools. Organizations should prioritize data protection in their technology implementations.
Source checks
Linked-source text retrieved.
Automated check recorded — 16 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within the Department for Work and Pensions (DWP). DWP implemented the Xerox Reprographics application into CM Appeals to handle and redact CM Appeals bundles. No testing or data protection impact assessment (DPIA) was completed before implementing the application into CM Appeals. This is because DWP did not consider it necessary due to the application already being used in other service areas of DWP (such as Personal Independent Payment (PIP) Appeals). However, the redaction requirements for CM appeals are different from the other service areas the application was already implemented in. As such, the redaction functionality of the application was not tested to confirm it was compatible with CM Appeals. This resulted in CM Appeals bundles being sent to individuals unredacted, resulting in the personal data of 16 data subjects being inappropriately disclosed to third parties.
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for Department for Work and Pensions in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
31 October 2022
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. Department for Work and Pensions - United Kingdom (2022). Retrieved from cookiefines.eu
Last updated: