Guide
Responding to data breaches: legal requirements
What to do when you discover a personal data breach. Covers the 72-hour ICO notification rule, when you must notify affected individuals, and how to document and manage a breach to meet your legal obligations.
A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data. This includes:
- Sending personal data to the wrong recipient
- Losing a laptop, phone, or USB drive containing personal data
- Cyber attacks that access customer or employee records
- Ransomware that encrypts personal data you cannot recover
- An employee accessing records without authorisation
- Accidental deletion of data you needed to keep
If you experience a breach, you must act quickly. UK GDPR gives you just 72 hours to notify the Information Commissioner's Office (ICO) if the breach poses a risk to individuals.
How to respond to a data breach
When you discover or suspect a breach, follow these steps immediately. The 72-hour clock starts when you have reasonable certainty that personal data has been compromised - not when you know all the details.
-
Step 1: Contain the breach
Take immediate action to stop the breach and limit damage. This might mean disabling compromised user accounts, isolating affected systems, recovering lost devices, or blocking unauthorised access. Do not wait until you understand everything - act first.
-
Step 2: Assess what happened
Investigate to establish: what personal data was involved, how many individuals are affected, what caused the breach, and what harm could result. Consider whether data was encrypted or otherwise protected. You do not need complete answers to proceed - the ICO expects you to report early and update later.
-
Step 3: Decide if ICO notification is required
Ask: is the breach likely to result in a risk to people's rights and freedoms? If yes, you must notify the ICO within 72 hours. If the breach is unlikely to result in any risk (for example, encrypted data was lost but the encryption key is secure), you do not need to notify - but you must still document the breach internally.
-
Step 4: Notify the ICO (if required)
Use the ICO's online breach reporting tool at ico.org.uk, or call 0303 123 1113 during office hours. You must provide: the nature of the breach, categories and numbers of people affected, your DPO or contact point details, the likely consequences, and the measures you are taking. If you cannot provide all details, report what you know and provide updates later.
-
Step 5: Notify affected individuals (if high risk)
If the breach is likely to result in a HIGH risk to individuals' rights and freedoms, you must notify them directly without undue delay. Use clear, plain language. Tell them what happened, the likely consequences, what you are doing about it, and what they can do to protect themselves.
-
Step 6: Document the breach
Record the breach in your internal breach register, regardless of whether you notified the ICO. Document: the facts of the breach, its effects, the remedial action taken, and your reasoning for whether to notify. The ICO can ask to see this record during an audit.
-
Step 7: Review and improve
After the immediate response, conduct a post-incident review. Identify what went wrong, whether existing controls failed, and what changes will prevent recurrence. Update your security measures, policies, and staff training as needed.
When you must notify the ICO
You must report a breach to the ICO within 72 hours if it is likely to result in a risk to people's rights and freedoms. This includes risks of:
- Financial loss or fraud (for example, if bank details were exposed)
- Identity theft (for example, if passport numbers or national insurance numbers were accessed)
- Discrimination (for example, if health or religious data was disclosed)
- Reputational damage (for example, if embarrassing information was leaked)
- Physical harm (for example, if home addresses were disclosed to an abuser)
- Significant distress or anxiety
When in doubt, notify. The ICO prefers organisations to report breaches that turn out to be less serious than expected, rather than fail to report breaches that cause harm.
When you do not need to notify the ICO
You do not need to report a breach if it is unlikely to result in any risk to individuals' rights and freedoms. Examples include:
- A lost device where the data was encrypted with a strong encryption key that was not compromised
- An email sent to the wrong internal colleague who immediately deleted it without reading
- Accidental deletion of data that was immediately recovered from backup with no exposure
- A breach affecting data that was already publicly available
Important: Even if you do not need to notify the ICO, you must still document the breach internally. The ICO can audit your breach records to check you are making appropriate decisions about notification.
Notifying affected individuals
If the breach is likely to result in a high risk to individuals, you must notify them directly - not just the ICO. This is a higher threshold than ICO notification. You must notify individuals when the breach could seriously affect their everyday life, safety, or finances.
What to tell affected individuals
Your notification must be in clear, plain language and include:
- A description of what happened (in general terms)
- The name and contact details of your Data Protection Officer or another contact point
- The likely consequences of the breach
- What you are doing to address the breach and mitigate harm
- What they can do to protect themselves (for example, changing passwords, monitoring bank statements, being alert to phishing)
When you do not need to notify individuals
You may not need to notify individuals directly if:
- You have applied technical measures (such as encryption) that render the data unintelligible to anyone without the key
- You have taken subsequent measures that ensure the high risk is no longer likely to materialise
- Individual notification would involve disproportionate effort - in which case you must make a public communication or similar measure that informs people equally effectively
The 72-hour rule: what if you cannot investigate in time?
You do not need a complete picture before reporting. If you cannot fully investigate within 72 hours, the ICO expects you to:
- Report what you know - Submit an initial report with the information you have
- Explain what you are still investigating - Tell the ICO what information is still being gathered
- Provide updates without undue delay - Submit further information as your investigation progresses
The ICO actively encourages this "report early, update later" approach. It is better to report on time with partial information than to delay until you have complete details.
If you miss the 72-hour deadline: You must still report the breach and explain why notification was delayed. Document the reasons for the delay carefully.
Penalties for failing to report
Failure to notify a reportable breach to the ICO can result in significant fines. Breach notification failures fall under the standard penalty tier.
In practice, the ICO is more likely to take enforcement action if:
- You failed to report a serious breach
- You significantly delayed notification without good reason
- You failed to notify affected individuals when required
- You do not have adequate breach detection or response procedures
- The same type of breach has happened before and you did not learn lessons
The ICO considers cooperation and prompt notification as mitigating factors when deciding on enforcement action.
Keeping breach records
UK GDPR Article 33(5) requires you to maintain records of all personal data breaches, whether or not you reported them to the ICO. Your breach register should include:
- The date and time the breach was discovered
- A description of what happened
- The categories and approximate number of individuals affected
- The categories and approximate number of records affected
- The likely consequences of the breach
- The measures taken to address and mitigate the breach
- Whether the breach was reported to the ICO (and if not, why not)
- Whether affected individuals were notified
The ICO can request access to your breach records during an audit or investigation. Good records demonstrate that you are taking data protection seriously and making appropriate decisions about notification.
Preparing before a breach happens
The 72-hour deadline is tight. Preparing in advance will help you respond quickly and meet your obligations.
-
Create a breach response plan
Document who is responsible for breach response, how breaches should be reported internally, and the steps to follow. Make sure key staff know where to find this plan.
-
Set up a breach register
Have a template or system ready to record breaches. Include all the fields required by Article 33(5) so you can capture information quickly.
-
Identify your ICO contact point
Know who will be responsible for liaising with the ICO. This is usually your Data Protection Officer if you have one, or a nominated senior person.
-
Train staff to recognise and report breaches
Employees are often the first to notice a breach. Train them to recognise potential breaches and report them immediately to the right person internally.
-
Keep contact information ready
Have ICO contact details, your DPO contact details, and templates for notifying individuals ready to use. You will not have time to create these during a breach.
-
Test your response
Run a practice scenario annually to check your plan works and staff know what to do. Update the plan based on lessons learned.