More than a majority of United Kingdom employees recently surveyed admitted to violating the General Data Protection Regulation (GDPR) shortly after it went into effect in May 2018 by forwarding a customer email to their personal accounts.

British technology services provider Probrand said it surveyed 1,002 full- or part-time U.K. employees, 64 percent of whom fessed up to committing the breach in the four months following introduction of GDPR.

In addition, 84 percent of those who admitted to forwarding the customer emails said there was no malicious intent behind their actions and thus they did not feel that they were doing anything wrong. Unfortunately, this is likely no defense to an alleged GDPR breach and the nightmares it may cause, said Matt Royle, marketing director at Probrand.

“What may seem like an innocent and even helpful action of workers trying to catch up on work out of hours is actually a clear breach of GDPR laws,” he said in a statement. But “seemingly innocent actions could have substantial repercussions. A GDPR breach can result in fines that potentially run into the millions. This financial impact along with the knock on effects this can have for businesses, including reputational damage, the loss of customer loyalty and trust, can be hugely damaging for companies in the long term.”

Although “worrying,” the results are not necessarily surprising, Royle said, given that earlier research from Probrand found that 55 percent of all U.K.-based businesses were breaching GDPR laws by not having an official process or protocol for disposing of obsolete IT equipment.

The results may be even more troubling to companies in light of the fact that data from the U.K.'s Information Commissioner's Office (ICO) revealed that the number of reported whistleblower complaints about potential data breaches at businesses have increased 165 percent since last May. The European Union's expansive regulation imposes new rules on any entity that offers goods and services to people in the European Union or that collects, processes or stores data tied to EU citizens.

“Given the amount of publicity around GDPR it is perhaps surprising that more workers (and employers) are not aware of the basics of what is required for GDPR compliance,” Royle said. “It is clear from these findings that businesses need to do more to educate their employees on the laws surrounding GDPR and data protection.”

In November, it was revealed that a Portuguese hospital was seemingly the first business to be hit with a monetary penalty under the GDPR, after it was fined 400,00 euros—about $453,000—by the country's data protection supervisory authority for allowing too many users to have access to patient data in the hospital's patient management system.

The hospital, Central Hospital of Barreiro Montijo, is appealing the decision, and may initiate legal proceedings, it said at the time.