The Department for Work and Pensions (DWP) has confirmed that several staff members have been dismissed בעקבות incidents involving unauthorised access to personal data. The update follows a parliamentary inquiry that brought attention to how internal data breaches are handled within the department.
The figures highlight both the scale of disciplinary action and the importance placed on safeguarding sensitive information held by the DWP.
Inquiry
The disclosure came after a question raised in Parliament by Conservative MP Mike Wood. The inquiry asked whether any disciplinary actions or dismissals had occurred among DWP staff or associated agency officials due to unauthorised access to personal data since July 2024.
In response, the DWP provided updated figures outlining internal actions taken over a 12 month period.
Figures
According to the department, seven employees were dismissed for unauthorised access to personal data within the past year. In addition, more than 200 staff members faced disciplinary proceedings related to similar issues.
A more detailed breakdown shows:
| Category | Number of Cases |
|---|---|
| Total employees | 94,876 |
| Disciplinary cases | 227 |
| Staff dismissed | 7 |
These figures include both open and closed cases over the 12 month period up to late February 2026.
Policy
The DWP maintains strict policies regarding access to personal data. Employees are required to follow established guidelines that define how information should be handled, accessed, and stored.
The department’s acceptable use policy, last updated in April, outlines clear expectations for all staff, contractors, and consultants who interact with DWP systems.
Rules
Under the policy, staff must only access personal data when there is a legitimate business need. Accessing records without proper justification is considered a breach, regardless of intent.
The guidance explicitly states that employees must not access:
- Their own records
- Records of family members or friends
- Information related to acquaintances or former partners
These restrictions apply across all systems, including digital platforms and paper records.
Training
To reinforce these standards, all employees are required to complete annual security training. This training covers responsibilities related to data protection and outlines procedures for reporting suspected breaches.
Staff are also expected to understand their legal obligations and adhere to broader civil service codes of conduct.
Responsibility
The DWP has stated that safeguarding personal data is a core responsibility. According to officials, all employees are expected to report any suspected misuse or breach of information.
The department emphasises that misuse of data for personal reasons or external interests is strictly prohibited.
Limits
While the department provided detailed figures on internal disciplinary cases, it noted that additional breakdowns were not readily available. Specifically, data regarding executive agencies or further classifications would require significant resources to compile, as it is not centrally stored.
Impact
The reported cases illustrate the challenges large organisations face in managing sensitive information across a wide workforce. With nearly 95,000 employees, maintaining consistent compliance requires ongoing oversight and enforcement.
Although the number of dismissals is relatively small compared to the total workforce, the volume of disciplinary cases suggests that monitoring and prevention remain ongoing priorities.
The DWP’s response underscores the importance of strict data protection policies and regular staff training. As public institutions continue to manage large volumes of personal data, adherence to these standards remains essential for maintaining trust and ensuring legal compliance.
FAQs
How many staff were dismissed?
Seven employees were dismissed.
How many faced disciplinary action?
Over 200 staff had cases opened.
What is unauthorised access?
Accessing data without valid work reason.
Can staff view their own records?
No, this is strictly prohibited.
