Phishing emails remain one of the most common and damaging cyber threats affecting organisations today. These attacks are designed to trick individuals into revealing sensitive information, transferring money, or downloading malicious software. As phishing techniques become increasingly sophisticated, particularly with the rise of artificial intelligence (AI) and Business Email Compromise (BEC) attacks, organisations face growing financial, operational, and regulatory risks under the UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018 (“DPA 2018”). Understanding how phishing attacks work and how to mitigate them is therefore essential across both the public and private sectors.
Understanding Phishing Emails
Phishing is a form of cyberattack and social engineering where attackers attempt to trick individuals into revealing sensitive information, downloading malware, or carrying out harmful actions. According to the UK Government’s Cyber Security Breaches Survey, phishing remains the most common cyber threat facing UK businesses, with 84% of organisations experiencing a breach or attack identifying phishing activity as a contributing factor.
Phishing attacks can occur through various channels, but email remains one of the most common methods used by cyber criminals. Attackers often impersonate trusted organisations such as banks, delivery companies, colleagues, online services, or government bodies to create a sense of urgency or trust. Recent examples have included fake NHS account verification emails targeting both healthcare staff and patients through spoofed login portals.
These emails may encourage recipients to click malicious links, open infected attachments, share login credentials, or transfer money. In some cases, attackers impersonate employees, suppliers, or senior executives in what is commonly known as a Business Email Compromise (BEC) attack. BEC attacks are designed to manipulate individuals into making fraudulent payments, disclosing confidential information, or changing financial details such as payroll or supplier bank account information.
The Federal Bureau of Investigation (FBI) has reported that BEC is one of the fastest-growing and most financially damaging forms of cyber-enabled fraud globally. Criminals increasingly use compromised business email accounts, spoofed domains, and social engineering techniques to make fraudulent requests appear legitimate and convincing. The consequences of phishing attacks can be significant. In addition to financial loss, organisations may experience operational disruption, reputational damage, ransomware deployment, and unauthorised access to sensitive personal data.
The Regulatory Risk: UK GDPR Compliance
From a data protection standpoint, falling victim to phishing emails may indicate wider weaknesses in an organisation’s security and governance framework. Under Article 5(1)(f) of the UK GDPR, organisations must process personal data in a manner that ensures appropriate security and protects against unauthorised or unlawful processing, accidental loss, destruction, or damage. In addition, Article 32 UK GDPR requires controllers and processors to implement appropriate technical and organisational measures to maintain a level of security appropriate to the risk.
The DPA 2018 gives the Information Commissioner’s Office (ICO) enforcement powers, including the ability to conduct investigations and issue reprimands, enforcement notices, and monetary penalties where organisations fail to adequately protect personal data.
In practice, appropriate security safeguards may include:
- staff awareness training;
- multi-factor authentication (MFA);
- access controls and least privilege principles;
- vulnerability management and patching;
- security monitoring and logging; and
- anti-phishing protections.
Where organisations fail to implement adequate safeguards against phishing attacks, they may face regulatory scrutiny and enforcement action. A successful phishing attack can result in unauthorised access to personal data, potentially constituting a personal data breach under the UK GDPR and DPA 2018.
Depending on the nature and severity of the incident, organisations may also be required to notify the ICO within 72 hours and, in some cases, inform affected individuals. Even where phishing attempts do not result in a reportable personal data breach, organisations should maintain internal records of incidents, attempted attacks, and associated risk assessments. For more information on responding to security incidents, please see our article on The Best Way To Respond To A Data Security Incident.
The Data (Use and Access) Act 2025 (“DUAA”) has also amended aspects of the UK’s data protection framework. In particular, it introduced a new recognised legitimate interest for processing that is necessary for the prevention, detection, or investigation of crime. ICO guidance confirms that this may include activities relating to scams, fraud, and money laundering. As such, these provisions may support certain fraud prevention, cyber threat intelligence, and information-sharing activities aimed at identifying and disrupting malicious campaigns. For more information on recognised legitimate interest and the DUAA, please see our article on Data Use and Access Act (DUA) 2025.
Real-World Example: ICO Enforcement Following a Phishing Attack
Recent ICO enforcement action demonstrates the potential regulatory consequences of inadequate phishing and cybersecurity controls under the UK GDPR and DPA 2018. In May 2026, the ICO issued a monetary penalty notice of £963,900 against South Staffordshire Plc and South Staffordshire Water Plc following a cyberattack linked to a successful phishing campaign.
According to the investigation, the attack began when an employee opened a malicious attachment received through a phishing email. The attachment installed malware onto the employee’s device, enabling attackers to gain an initial foothold within the organisation’s IT environment. The attackers then established persistent access and later moved laterally across multiple systems and privileged accounts over an extended period before the incident was identified.
The ICO identified several weaknesses in the organisation’s security and governance controls. These included deficiencies in access controls, implementation of the principle of least privilege, inadequate security monitoring and logging, the continued use of obsolete software, and insufficient vulnerability management processes.
The incident ultimately resulted in the unauthorised disclosure of personal data relating to approximately 633,887 individuals. The compromised data included customer information, employee records, bank account details, usernames and passwords, and some special category data. Some affected individuals were also identified as vulnerable customers registered under the organisation’s Priority Services Register.
The ICO concluded that the organisations had infringed Article 5(1)(f) UK GDPR, which requires personal data to be processed securely and protected against unauthorised or unlawful processing, as well as Article 32(1) UK GDPR, which requires organisations to implement appropriate technical and organisational security measures.
The resulting monetary penalty notice was issued under section 155 of the DPA 2018, which gives the ICO enforcement powers where organisations fail to comply with UK GDPR obligations relating to the security and protection of personal data.
This case highlights how phishing attacks are not solely an IT issue, but also a significant compliance, governance, and accountability concern under the UK GDPR and DPA 2018.
The Rise of AI-Driven Phishing Attacks
Modern phishing campaigns are becoming harder to detect. The ICO has warned that phishing attacks continue to evolve, while industry research has identified a growing number of phishing emails bypassing traditional secure email gateways (SEGs) and reaching employee inboxes.
Cyber criminals are also making use of phishing kits and attack frameworks designed to imitate legitimate websites and login pages. Some of these tools are now widely available online, lowering the barrier for less experienced attackers to launch convincing phishing campaigns.
Artificial intelligence (AI) is further changing the phishing landscape. Large language models (LLMs), such as ChatGPT, can be used to generate realistic phishing emails with convincing language, correct grammar, and tailored messaging. This makes it much harder for individuals to distinguish malicious emails from legitimate communications.
AI-generated phishing attacks may also include:
- highly personalised messages;
- fake websites designed to mirror trusted brands;
- QR code phishing attacks;
- voice cloning and deepfake audio;
- AI-generated videos impersonating real individuals; and
- attempts to bypass multi-factor authentication (MFA).
As phishing techniques continue to evolve, organisations should regularly review emerging risks and ensure layered security controls remain effective. This includes understanding not only how AI may be used by attackers, but also how AI is being introduced and used within the organisation itself. Effective governance, clear policies, staff awareness and appropriate risk assessments can all help organisations respond to the changing threat landscape.
While attackers are increasingly using AI to improve phishing campaigns, AI-powered security tools are also helping organisations strengthen detection and response capabilities.
Mitigating the Risks of Phishing
Although phishing risks cannot be eliminated entirely, adopting layered technical and organisational controls can significantly reduce both the likelihood and impact of attacks. The UK National Cyber Security Centre (NCSC) recommends adopting a combination of preventative measures, employee awareness initiatives, and incident response processes to strengthen organisational resilience against phishing attacks.
1. Strengthen Email Security Controls
Effective email security measures should be implemented to reduce malicious emails reaching employee inboxes. This may include:
- spam and malware filtering;
- anti-spoofing protections such as sender policy framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC);
- secure email gateways (SEGs); and
- web filtering to block known malicious websites.
These controls can help prevent phishing emails from reaching end users, although no filtering solution is completely effective, particularly as phishing attacks become increasingly sophisticated and AI-generated.
2- Improve Staff Awareness and Reporting
Employees remain one of the most common targets for phishing attacks. Regular cybersecurity and data protection awareness training can help staff identify suspicious emails, malicious links, unusual payment requests, and credential harvesting attempts.
The NCSC also emphasises the importance of creating a positive reporting culture. Employees should feel comfortable reporting suspicious emails or mistakes quickly without fear of blame or disciplinary action, as early reporting can significantly reduce the impact of an incident.
3- Apply Strong Access Controls
Attackers frequently attempt to escalate privileges after compromising a user account. Organisations should therefore apply the principle of least privilege by limiting user access rights to only what is necessary for their role.
Administrative accounts should be tightly controlled and should not be routinely used for everyday activities such as browsing the internet or checking emails.
4- Implement Multi-Factor Authentication (MFA)
MFA adds an additional layer of protection by requiring users to verify their identity using a second authentication factor. Even where login credentials are compromised through phishing, MFA can help reduce the likelihood of unauthorised access to systems and personal data.
5- Maintain Effective Incident Response Processes
No organisation can eliminate phishing risks entirely. Having a clear incident response process enables organisations to detect, contain, investigate, and recover from phishing incidents more effectively.
This should include:
- clear reporting procedures;
- password reset processes;
- malware containment measures;
- assessment of whether ICO notification obligations apply under the UK GDPR and DPA 2018.
6- Maintain Ongoing Governance and Risk Assessment
Phishing risks should not be viewed solely as an IT issue. Organisations should regularly review phishing risks as part of their wider cybersecurity, data protection, and governance framework. Maintaining records of phishing attempts, staff training, and risk assessments can also help demonstrate accountability under the UK GDPR.
Conclusion
Phishing remains one of the leading causes of cyber incidents and personal data breaches worldwide. By adopting a proactive and layered approach to phishing prevention, organisations can significantly reduce the likelihood and impact of attacks while strengthening regulatory compliance and operational resilience.
If you require support with phishing awareness training, incident response planning, or wider UK GDPR compliance, contact IGS at info@informationgovernanceservices.com to discuss how we can help your team.
