Annual data protection statement -

2025 to 2026 at a glance

Strategic overview

Overall position

The council’s information governance position strengthened in 2025 to 2026 with:

• core statutory performance remaining controlled
• incident severity reduced
• records, transparency and data protection officer (DPO) and information governance (IG) oversight continuing to mature

What the data tells us

Demand is increasing and is more complex than in previous years with:

• Freedom of Information (FOI) and Environmental Impact Report (EIR) volumes rising by 10%
• Subject Access Requests (SARs) increasingly involving multi-directorate records and third-party data
• incident data showing preventable handling errors remain concentrated in higher-risk services

Assurance position

The available evidence does not point to systemic non-compliance. However, it does show that the council’s assurance position depends, increasingly, on the quality and consistency of service-level evidence. To remain confident and defensible, services need to:

• record the reasons for decisions clearly
• explain any exemptions or delays
• take visible ownership of information risk

Strategic assurance

FOI and EIR timeliness remained above target. SAR responses were controlled within agreed parameters. Incidents reportable to the Information Commissioner's Office (ICO) reduced, and no sanctions have arisen to date. Regulatory and internal review outcomes provide assurance, while also identifying learning.

Strategic priorities for 2026 to 2027

The next phase should focus on:

• evidencing FOI and EIR decisions
• embedding Data (use and access) Act guidance
• strengthening AI governance
• building SAR capability for complex cases
• reducing repeat incident themes
• improving retention discipline

Where attention is needed

Higher-volume and higher-risk services need targeted support so controls are practical, consistently applied and embedded into everyday service management. This work is already underway at the time of this report.

Risks and continual improvement - 2026 to 2027 action plan

Govern AI before use

Risk

Unapproved tools may expose:

• personal and confidential data
• reuse council information
• produce unreliable outputs

Action taken

Grok and DeepSeek have been blocked or restricted where assurance could not be demonstrated. This helps protect residents who trust us with their information or must share it with us.

Next steps

Maintain the approved-tools route, supplier and storage checks, lawful basis, human oversight and access controls.

Evidence

Approved-tools list, staff guidance and restrictions maintained and reviewed routinely.

Strengthen information rights decisions

Risk

Higher FOI and EIR volume, internal reviews and ICO notices show quality must keep pace with timeliness.

Action

Embed Data Use and Access Act (DUAA) guidance, improve search records, exemption and exception rationale, public interest and prejudice tests and requester explanations.

Next steps

Introduce a consistent FOI and EIR evidence standard and sample check higher-risk cases.

Evidence

Record searches, legislation applied, withholding rationale, public interest and prejudice test, advice and approval, and requester explanation.

Build Subject Access Request capability for complex cases

Risk

Complex Subject Access Requests (SARs) span multiple directorates and include third-party data, social care and SEND records, and significant redaction.

Action

Provide case clinics and training on scoping, ownership, searches, redaction, exemptions and coordinated sign-off.

Next steps

Target training and case clinics for complex, multi-directorate or high-redaction SARs.

Evidence

Earlier scoping, fewer avoidable delays and consistent audit trails.

Reduce repeat-incident themes

Risk

Repeat preventable errors persist, especially wrong-recipient email, attachments and redaction in high-volume sensitive services.

Action

Target service support, check-before-send controls, secure sharing, redaction QA and shared learning.

Next

Use incident trend data to target reminders, service support and controls in higher-risk areas.

Evidence

Trend monitoring by directorate and incident theme, with follow-up on repeat issues.

This local pattern reflects wider ICO trends, where many reported data security incidents continue to relate to non-cyber handling errors. This includes information sent to the wrong recipient.

2026 to 2027 deliverables

Key deliverables for 2026 to 2027 are:

• Maintain restrictions on unassured AI tools
• FOI and EIR evidence standards
• SAR training and case clinics
• incident prevention activity
• retention
• disposal and access-review checks

Security incidents (personal data breaches)

Overall pattern - more reporting, fewer reportable breaches

In 2025 to 2026, 143 security incidents were recorded through the formal process, an increase from 124 in 2024 to 2025. Reporting was uneven across the year, with lower volumes in quarters 1 and 2 before a marked increase in quarters 3 and 4.

Despite the higher overall volume, ICO-reportable incidents reduced from 6 to 3. This suggests that most incidents were contained below the threshold for regulatory reporting.

Incident type by month

Security incidents breakdown by month

Main cause - practical handling errors

Wrong-recipient email accounted for 104 incidents. Further incidents were linked to:

• redaction failures
• use of BCC
• incorrect attachments
• wider checking errors

These incidents are largely preventable and point to the need for these continued practical controls:

• check-before-send prompts
• delayed send where appropriate
• secure sharing routes
• redaction quality assurance
• targeted reminders for teams handling high volumes of sensitive personal information

Targeted prevention - where support will have most impact

Incidents are concentrated in the People Directorate, accounting for 85% of the total. This is consistent with the volume and sensitivity of the information managed there.

From 2025 to 2026, the People Directorate reported 122 out of 143 incidents. Among these, 61 incidents involved vulnerable adults or children.

With email misdirection being the most common incident type, the focus for 2026 to 2027 is clear. We must:

• provide targeted support in higher-volume services
• improve attachment controls, redaction checks and secure sharing
• promote shared learning across services

Incident type by directorate

Total security incidents year on year

Freedom of Information and Environmental Information Regulations

Demand for Freedom of Information (FOI) and Environmental Information Regulations (EIR) increased again in 2025 to 2026.

1,359 requests were received between 1 April 2025 and 31 March 2026. This is an increase from 1,235 in the previous annual statement period, which is a rise of 10%.

The quarterly breakdown of requests for 2025 to 2026 was:

• quarter 1 - 313
• quarter 2 - 353
• quarter 3 - 323
• quarter 4 - 370

This shows sustained demand rather than a short-term issue.

The Information Commissioner’s Office (ICO) has published 4 decision notices relating to Bracknell Forest Borough Council’s handling of FOI and EIR requests.

Overall, the notices provide a broadly positive assurance position:

• in 3 cases, the commissioner did not require any steps to be taken
• 2 FOI cases were not upheld in relation to whether further information was held
• 1 EIR case supported the council’s reliance on the confidentiality of proceedings exception

Total number of FOI and EIR requests between 2025 and 2026

FOI and EIR requests by directorate and financial year

Monthly FOI and EIR completion rates

Response times

Performance remained strong despite the higher volume.

1,227 responses were submitted on time, while 119 were late. This gives an annual on-time rate of 91.2%. This compares favorably with the previous annual statement, where 79% of responses were on time.

The average response time was 12.9 days overall, down from 16.6 days.

For on-time responses, the average was 11.6 days, slightly lower than the previous 11.7 days.

Late responses took an average of 26.9 days, compared to 34.7 days before.

Internal reviews increased significantly from 2025 to 2026, rising to 42 compared to 17 in the previous reporting period. This represents about 3.1% of all FOI and EIR requests.

Reviews were concentrated in:

• Place - 15
• Communities - 13
• Planning - largest service-area cluster at 13 reviews

Most original responses that led to a review were issued on time. Specifically, 31 out of 42 met the statutory deadline. This suggests that the issue is more about decision quality, clarity of explanation, and exemption handling than just timeliness.

Exemptions

Demand continues to be driven mainly by individuals and commercial organisations.

Individuals made up about half of all requests. Commercial organisations were the next largest group, followed by requests from research and media. Directorate demand was focused on People, Communities, and Place.

The highest volume service areas were:

• Contract Services
• Planning
• Education and Learning
• Highways and Transport
• Commissioning
• Housing

Exemptions and refusals remain a notable assurance area. 237 cases were marked as having an exemption or refusal applied. The most common reasons were that the information:

• was already reasonably accessible
• involved personal information
• related to law enforcement
• exceeded cost limits
• concerned commercial interests

12% (158 requests) of all requests came from:

• 10 accounts
• 5 individuals
• 2 media organisations
• 3 commercial organisations

Category source

By requester

Subject access requests

Subject access requests (SARs) demand remained consistently high throughout 2025 to 2026. A total of 173 requests were recorded across the year. Volumes were stable across all 4 quarters, showing sustained operational demand rather than a short-term spike.

The majority of requests continued to relate to People Directorate services, particularly children’s social care, SEND and adult social care. However, the year also saw a noticeable level of multi-directorate requests. This reflects the complexity of cases where records are held across several service areas.

Overall, control remained reasonable.

Of the SARs responded to, 88.5% were completed on time. Most completed SARs met the statutory deadline. Late cases were mainly concentrated in complex People or multi-directorate requests. This reinforces the need for:

• early scoping
• clear ownership
• timely service-area responses
• robust audit trails

Allocation by directorate by month

Open request status (current year)

SAR complexity and redaction

63% of completed SARs required partial or full redaction of third-party information. There were 72 cases closed as “Completed – 3rd party data redacted.” This shows the ongoing complexity of SARs, especially when records involve children’s services, adult social care, SEN, or multi-directorate information.

Of the SARs responded to, 88.5% were completed on time. The SARs recorded as late exceeded either the statutory deadline or an agreed extension period.

Statutory deadline met

Average response time (in days) for requests completed per month