The number of high-risk personal data breaches reported in Guernsey has fallen by almost half, according to the latest figures from the Office of the Data Protection Authority (ODPA).
Four breaches were classified as high-risk between April and June, down from seven in the previous quarter and 20 in the third quarter of 2025.
That means the number of high-risk incidents has fallen by 80% in just nine months.
Data Protection Commissioner Brent Homan said the decline was “encouraging to see”.
However, the wider number of personal data breaches being reported remains higher than it was several years ago.
The ODPA received 49 breach reports during the second quarter of 2026.
That compares with 39 in the same quarter of 2024, although it is down from a recent peak of 65 in the first quarter of this year.
The number of breaches reported annually fell from 180 in 2020 to 151 in 2022, before rising again.
There were 154 reported breaches in 2024, while the quarterly figures for 2025 show reports reaching 62 in the third quarter and 61 in the fourth.
Mr Homan said: “When organisations report breaches they not only fulfil an important legal obligation but can benefit from our office’s expertise in mitigating any harmful effects of a security incident.
“This report also reminds us that breaches are not just about records but include overheard conversations.”
Ten of the 49 breach reports received during the latest quarter were ultimately found not to have met the threshold for a reportable data breach.
As has historically been the case, emails sent to incorrect recipients were again the most common type of breach reported.
Organisations are legally required to notify the ODPA of any personal data breach within 72 hours of becoming aware of it.
The authority encourages organisations which are unsure whether an incident is reportable to contact it for guidance.
