Data protection compliance

Responding to data breaches: legal requirements

What to do when you discover a personal data breach. Covers the 72-hour ICO notification rule, when you must notify affected individuals, and how to document and manage a breach to meet your legal obligations.

UK-wide
Guide summary

You must report a personal data breach to the ICO within 72 hours if it could harm people. Tell affected individuals if the risk is high. Keep records of all breaches.

  • Report breaches to ICO within 72 hours if risk to people
  • Tell affected individuals directly if risk is high
  • Record all breaches internally even if no risk
  • Use ICO online tool or call 0303 123 1113 to report
  • Include nature of breach and number of people affected
  • Fines up to £8.7 million for not reporting
  • Act immediately to stop and limit the breach
  • Assess risk even without full details
  • Review and improve security after breach
  • Keep records for audits
On this page
UK-wide

Related guides in Compliance & Legal

Report a cyber incident

Emergency response guide for reporting cyber attacks and data breaches. Covers who to contact (Report Fraud, ICO, NCSC, …

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of personal data. This includes:

  • Sending personal data to the wrong recipient
  • Losing a laptop, phone, or USB drive containing personal data
  • Cyber attacks that access customer or employee records
  • Ransomware that encrypts personal data you cannot recover
  • An employee accessing records without authorisation
  • Accidental deletion of data you needed to keep

If you experience a breach, you must act quickly. UK GDPR gives you just 72 hours to notify the Information Commissioner's Office (ICO) if the breach poses a risk to individuals.

How to respond to a data breach

When you discover or suspect a breach, follow these steps immediately. The 72-hour clock starts when you have reasonable certainty that personal data has been compromised - not when you know all the details.

  1. 1

    Step 1: Contain the breach

    Take immediate action to stop the breach and limit damage. This might mean disabling compromised user accounts, isolating affected systems, recovering lost devices, or blocking unauthorised access. Do not wait until you understand everything - act first.

  2. 2

    Step 2: Assess what happened

    Investigate to establish: what personal data was involved, how many individuals are affected, what caused the breach, and what harm could result. Consider whether data was encrypted or otherwise protected. You do not need complete answers to proceed - the ICO expects you to report early and update later.

  3. 3

    Step 3: Decide if ICO notification is required

    Ask: is the breach likely to result in a risk to people's rights and freedoms? If yes, you must notify the ICO within 72 hours. If the breach is unlikely to result in any risk (for example, encrypted data was lost but the encryption key is secure), you do not need to notify - but you must still document the breach internally.

  4. 4

    Step 4: Notify the ICO (if required)

    Use the ICO's online breach reporting tool at ico.org.uk, or call 0303 123 1113 during office hours. You must provide: the nature of the breach, categories and numbers of people affected, your DPO or contact point details, the likely consequences, and the measures you are taking. If you cannot provide all details, report what you know and provide updates later.

  5. 5

    Step 5: Notify affected individuals (if high risk)

    If the breach is likely to result in a HIGH risk to individuals' rights and freedoms, you must notify them directly without undue delay. Use clear, plain language. Tell them what happened, the likely consequences, what you are doing about it, and what they can do to protect themselves.

  6. 6

    Step 6: Document the breach

    Record the breach in your internal breach register, regardless of whether you notified the ICO. Document: the facts of the breach, its effects, the remedial action taken, and your reasoning for whether to notify. The ICO can ask to see this record during an audit.

  7. 7

    Step 7: Review and improve

    After the immediate response, conduct a post-incident review. Identify what went wrong, whether existing controls failed, and what changes will prevent recurrence. Update your security measures, policies, and staff training as needed.

When you must notify the ICO

You must report a breach to the ICO within 72 hours if it is likely to result in a risk to people's rights and freedoms. This includes risks of:

  • Financial loss or fraud (for example, if bank details were exposed)
  • Identity theft (for example, if passport numbers or national insurance numbers were accessed)
  • Discrimination (for example, if health or religious data was disclosed)
  • Reputational damage (for example, if embarrassing information was leaked)
  • Physical harm (for example, if home addresses were disclosed to an abuser)
  • Significant distress or anxiety

When in doubt, notify. The ICO prefers organisations to report breaches that turn out to be less serious than expected, rather than fail to report breaches that cause harm.

When you do not need to notify the ICO

You do not need to report a breach if it is unlikely to result in any risk to individuals' rights and freedoms. Examples include:

  • A lost device where the data was encrypted with a strong encryption key that was not compromised
  • An email sent to the wrong internal colleague who immediately deleted it without reading
  • Accidental deletion of data that was immediately recovered from backup with no exposure
  • A breach affecting data that was already publicly available

Important: Even if you do not need to notify the ICO, you must still document the breach internally. The ICO can audit your breach records to check you are making appropriate decisions about notification.

Notifying affected individuals

If the breach is likely to result in a high risk to individuals, you must notify them directly - not just the ICO. This is a higher threshold than ICO notification. You must notify individuals when the breach could seriously affect their everyday life, safety, or finances.

What to tell affected individuals

Your notification must be in clear, plain language and include:

  • A description of what happened (in general terms)
  • The name and contact details of your Data Protection Officer or another contact point
  • The likely consequences of the breach
  • What you are doing to address the breach and mitigate harm
  • What they can do to protect themselves (for example, changing passwords, monitoring bank statements, being alert to phishing)

When you do not need to notify individuals

You may not need to notify individuals directly if:

  • You have applied technical measures (such as encryption) that render the data unintelligible to anyone without the key
  • You have taken subsequent measures that ensure the high risk is no longer likely to materialise
  • Individual notification would involve disproportionate effort - in which case you must make a public communication or similar measure that informs people equally effectively

The 72-hour rule: what if you cannot investigate in time?

You do not need a complete picture before reporting. If you cannot fully investigate within 72 hours, the ICO expects you to:

  1. Report what you know - Submit an initial report with the information you have
  2. Explain what you are still investigating - Tell the ICO what information is still being gathered
  3. Provide updates without undue delay - Submit further information as your investigation progresses

The ICO actively encourages this "report early, update later" approach. It is better to report on time with partial information than to delay until you have complete details.

If you miss the 72-hour deadline: You must still report the breach and explain why notification was delayed. Document the reasons for the delay carefully.

Penalties for failing to report

Failure to notify a reportable breach to the ICO can result in significant fines. Breach notification failures fall under the standard penalty tier.

In practice, the ICO is more likely to take enforcement action if:

  • You failed to report a serious breach
  • You significantly delayed notification without good reason
  • You failed to notify affected individuals when required
  • You do not have adequate breach detection or response procedures
  • The same type of breach has happened before and you did not learn lessons

The ICO considers cooperation and prompt notification as mitigating factors when deciding on enforcement action.

Keeping breach records

UK GDPR Article 33(5) requires you to maintain records of all personal data breaches, whether or not you reported them to the ICO. Your breach register should include:

  • The date and time the breach was discovered
  • A description of what happened
  • The categories and approximate number of individuals affected
  • The categories and approximate number of records affected
  • The likely consequences of the breach
  • The measures taken to address and mitigate the breach
  • Whether the breach was reported to the ICO (and if not, why not)
  • Whether affected individuals were notified

The ICO can request access to your breach records during an audit or investigation. Good records demonstrate that you are taking data protection seriously and making appropriate decisions about notification.

Preparing before a breach happens

The 72-hour deadline is tight. Preparing in advance will help you respond quickly and meet your obligations.

  1. 1

    Create a breach response plan

    Document who is responsible for breach response, how breaches should be reported internally, and the steps to follow. Make sure key staff know where to find this plan.

  2. 2

    Set up a breach register

    Have a template or system ready to record breaches. Include all the fields required by Article 33(5) so you can capture information quickly.

  3. 3

    Identify your ICO contact point

    Know who will be responsible for liaising with the ICO. This is usually your Data Protection Officer if you have one, or a nominated senior person.

  4. 4

    Train staff to recognise and report breaches

    Employees are often the first to notice a breach. Train them to recognise potential breaches and report them immediately to the right person internally.

  5. 5

    Keep contact information ready

    Have ICO contact details, your DPO contact details, and templates for notifying individuals ready to use. You will not have time to create these during a breach.

  6. 6

    Test your response

    Run a practice scenario annually to check your plan works and staff know what to do. Update the plan based on lessons learned.