Cornwall Council Data Breach Exposes Unredacted Complainant PIIs
Published on February 23, 2026
Key Takeaways
- Breach Details: Cornwall Council inadvertently disclosed unredacted personal data of ten complainants to the subject of their complaints, Councillor Dulcie Tudor.
- Data Exposed: The breach compromised personally identifiable information (PII) of people who explicitly requested anonymity.
- Extended Actions: The incident involved the Free Speech Union in the proceedings, further exposing private data to others.
A Cornwall Council data breach has occurred, stemming from the improper handling of formal complaints filed against a local official. The breach transpired when the council forwarded documents related to ten complaints to Councillor Dulcie Tudor.
Though the council attempted to redact the files, the process failed upon opening, thereby exposing the complete PII of all ten complainants, including four individuals who had explicitly withdrawn consent for their names to be shared.
UK Data Protection and Technical Safeguards
Proper U.K. data protection mandates that PII, especially in sensitive contexts like formal complaints, be rigorously protected from unauthorized disclosure. Reports say the exposed data set contained information that standard protocol dictates must be secured:
- Full names,
- Home addresses,
- Email addresses,
- Telephone numbers.
The situation was exacerbated as Councillor Tudor, in preparing the legal defense, was required to share the unredacted documents with the Free Speech Union, further propagating the compromised data.
These complaints were filed in response to comments the Councillor made during a public meeting concerning gender identity definitions. The failure of what appears to be a digital redaction tool highlights a critical vulnerability in the authority's data processing workflow.
Impending ICO Investigation and Implications
It is yet unclear whether the data breach has been escalated to the Information Commissioner's Office. The council told her that there was no wrongdoing since the complaints were sent as redacted attachments, the councillor posted.
In other recent news, a Ravenna Hub data breach exposed child information available on the student admissions portal. Last month, the U.K. government proposed a new cyber action plan after admitting flaws in the nation’s cyber resilience strategy.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular