Most data breaches do not start with a hacker in a hoodie. Many start with a normal member of staff using a normal account to access a normal system.

That makes them harder to explain. The person may have a legitimate login. They may work in the right department. They may access the same system every day. The problem starts when they access information for the wrong reason.

This issue has returned to the headlines because of recent NHS incidents where staff looked at patient records without a clinical or operational need. The Information Commissioner's Office has warned healthcare organisations that curiosity is not an excuse and that staff can face disciplinary action, loss of professional accreditation and prosecution when they knowingly or recklessly access personal data without authorisation.

The lesson applies far beyond healthcare. It affects councils, police forces, law firms, managed service providers, manufacturers, sales teams, software developers and any business that holds personal, commercial or confidential information.

The key point is simple: being able to access data does not mean you have permission to use it for any purpose you choose.

Real-world examples

The cases below show the same pattern across healthcare, policing, commercial data, sales records and software code. In each case, access rights did not create a free right to browse, copy, retain or reuse the information.

The problem is not always access. The problem is purpose.

Many organisations focus heavily on whether someone can access a system. That matters, but it does not answer the full question.

A receptionist may need access to patient records for appointments. A salesperson may need access to CRM data for current customers. A police officer may need access to police systems for active policing duties. A developer may need access to source code repositories to maintain a product.

None of that gives the person permission to browse records out of curiosity, check up on people they know, copy customer data before leaving, send restricted information to a personal email account or reuse an employer's code in a new business.

This distinction matters because a lot of insider data misuse does not look like a technical breach at first. The login succeeds. The MFA prompt passes. The system records a normal session. The person may even sit at their normal desk, during normal working hours, using a device supplied by the organisation.

The breach only becomes clear when someone asks: why did they access that data?

What UK law and guidance say

Section 170 of the Data Protection Act 2018 creates an offence involving the deliberate or reckless obtaining, disclosure, procuring or retention of personal data without the consent of the controller. The Crown Prosecution Service summarises this offence in its guidance on data protection and computer misuse matters.

The Computer Misuse Act 1990 can also apply where someone knowingly accesses computer material without authorisation. Employers therefore need clear rules that define what authorised access means, because staff may have system access for one purpose but not another.

For personal data breaches, the ICO expects organisations to have breach detection, investigation and internal reporting procedures. Organisations must notify the ICO within 72 hours where a breach meets the reporting threshold, and they must inform affected individuals without undue delay where the breach creates a high risk to their rights and freedoms.

For insider data theft, the National Cyber Security Centre recommends measures that help organisations prevent, monitor and audit data exfiltration by malicious insiders. The NCSC also notes that insider risk does not only involve employees. It can involve contractors, partners and suppliers with legitimate access.

Why this matters to ordinary businesses

It would be easy to treat these cases as an NHS or public sector issue. That would be a mistake.

Every organisation has data that staff can access but should not misuse. Customer records, sales pipelines, HR files, supplier bank details, source code, legal files, case notes and internal pricing data can all create risk when staff use them for the wrong reason.

The same pattern appears again and again. The employee says they had access. The organisation says they had no business reason to use it that way.

Practical controls that reduce the risk

·        Write the rule clearly. Policies should state that staff may only access data when their role requires it for a legitimate work purpose. Avoid vague wording such as "staff must not misuse data". Use plain examples: do not look up friends, family, colleagues, celebrities, local incidents, former customers or records linked to news stories unless your role requires it.

·        Limit access where you can. Role-based access will not solve every issue, but it reduces unnecessary exposure. Staff should not keep access because they once needed it for an old project.

·        Monitor sensitive activity. Review access to VIP records, child records, employee records, high-profile incidents, bulk exports, unusual CRM downloads, personal email forwarding and source code cloning. Monitoring should not sit unused until after a complaint.

·        Treat leavers as a data risk. Before staff leave, check for unusual downloads, exports, repository clones, mass printing, USB transfers, email forwarding rules and messages sent to personal accounts. Sales teams, developers, finance staff and senior managers deserve particular attention because they often hold high-value information.

·        Train managers as well as staff. Many insider cases start with a manager saying, "They worked on that account, so it is probably fine." Managers need to understand the difference between past involvement and current business need.

·        Make consequences clear and consistent. If one person receives dismissal and another receives informal counselling for similar conduct, the policy loses credibility. Staff need to know that inappropriate access can lead to dismissal, professional referral, criminal prosecution or civil action.

·        Investigate quickly. The ICO expects organisations to recognise, investigate and document breaches. Where a breach creates a risk to individuals, organisations may need to notify the ICO. Where the breach creates a high risk to individuals, organisations may also need to tell the affected people directly.

A simple test for staff

A useful test for staff awareness training is: could I explain this access to the person whose data I opened, my manager, the ICO and a court?

If the answer is no, do not open the record.

A second test helps with customer lists, sales records and code: did I create this for myself, or did I create it as part of my job?

If the work, customer relationship, source code, spreadsheet, script or database came from employment, the employee should assume that the employer owns it unless a written agreement says otherwise.

Conclusion

Insider data misuse often starts with legitimate access. That makes it uncomfortable for organisations because it raises questions about culture, supervision, monitoring and accountability.

The recent NHS cases show the human impact when staff look at sensitive records out of curiosity. The RAC, Leaseline, Acorn, Trailfinders and PQ Systems cases show the commercial impact when staff copy data or code for personal gain, a competitor or a new employer.

Organisations should not frame this as a niche cyber issue. It is a governance issue, an HR issue, a legal issue and a trust issue.

The message to staff should be direct: your login lets you do your job. It does not give you permission to look at anything you like, copy anything useful or take anything with you when you leave.