His Majesty’s Inspectorate finds multiple breaches of UK police data by third-party suppliers

What happened

• The affected records include personal details of officers and members of the public.
• No specific penalty was announced, but the findings highlight systemic supplier security weaknesses.

Why it matters

Other public‑sector bodies that rely on external IT vendors should audit those contracts for security gaps and verify that suppliers meet UK GDPR requirements for data protection.

Business impact

Failure to tighten third‑party controls could expose agencies to further data loss, reputational damage, and potential regulatory action under the UK GDPR.

What to check

1. 1

   audit third‑party contractsHigh priority

   Review all existing IT supplier agreements for data‑security clauses and enforce GDPR‑compliant safeguards.

2. 2

   conduct supplier risk assessmentsMedium priority

   Perform technical and organisational risk assessments of each supplier handling police data.

3. 3

   implement continuous monitoringMedium priority

   Deploy monitoring tools to detect unauthorized access attempts in supplier environments.