The ICO has found serious failings in the way volunteers at a national dementia support charity handled sensitive personal data.
It has ordered The Alzheimer's Society to take action after discovering that volunteers were using personal email addresses to receive and share information about people who use the charity, storing unencrypted data on their home computers and failing to keep paper records locked away.
Furthermore, volunteers were not trained in data protection, the charity's policies and procedures were not explained to them and they had little supervision from staff.