Three Mandatory Breach Registers Now Set the Limits of What This Database Can Say

This corpus draws on three mandatory reporting regimes, and their scopes explain most of what it can and cannot establish.

Per-incident filings with named organisations, affected counts and dates, at 25-0630 — 343 in six months. It is why this database quotes 5,556,702 at Yale New Haven at 25-0308 and 13,924,906 at Aflac at 25-0618.

It covers one sector, which is why the corpus repeatedly warned that healthcare looks worse than others because it is the only one compelled to count.

All sectors, mandatory, eight years continuous, with causes distinguished — at 25-1229b, 25-1230b and 25-0802b.

It publishes aggregates rather than per-incident detail, so it supports trend and composition questions and not the naming of individual incidents. The two registers are complementary and neither substitutes for the other.

Fifteen reports across twenty-two months, at 25-1023. The corpus concluded the level was uninformative and the trend would not be — a regulator collecting consistently since 2024 will be able to say something in 2030 nobody can say about any other UK sector.

Availability. Workforce data, per 25-0704. Corporate information with no data subject, per 25-1124b. Organisations below the reporting threshold, per 25-0613b. Outcomes, per 25-1219.

Every gap this corpus has documented sits in the space between these three registers, and no combination of them closes it.

Where a register exists, this database has figures. Where none does, it has claims, estimates and leak-site listings — the four filters at 25-0502 restated as a consequence of regulatory geography.

Graded medium: this is a structural comparison of instruments recorded in this database, not a finding about incidents.