Journey
Data breach 72-hour checklist
Emergency checklist when you discover a personal data breach. Covers immediate containment, the 72-hour Information Commission notification rule, when to notify affected individuals, and who else to contact.
A data breach includes any incident where personal data is lost, stolen, accessed without authorisation, or sent to the wrong person. If you have discovered a breach, work through these steps immediately.
-
Contain the breach now
Stop the breach spreading. Disable compromised accounts. Isolate affected systems. Recover lost devices if possible. Do not wait until you understand everything - contain first, investigate second.
-
Assess what happened
Work out: what data was involved, how many people are affected, what harm could result. You do not need complete answers to report - the Commission expects early notification with updates later.
-
Decide: must you report to the Information Commission?
Report if the breach is likely to result in a risk to individuals. When in doubt, report. The Commission prefers over-reporting to under-reporting.
-
Report to the Information Commission (if required)
Use the Commission's online breach reporting tool. You will need: your contact details, nature of the breach, categories and numbers affected, likely consequences, and measures you are taking.
Report a data breach to the Information Commission (opens in a new tab)
-
Notify affected individuals (if high risk)
If the breach poses a high risk to individuals, you must notify them directly. Tell them what happened, what you are doing, and what they can do to protect themselves (e.g., change passwords, monitor bank statements).
-
Report cyber crime (if applicable)
If the breach resulted from a cyber attack, also report the crime. This is separate from notification to the Commission.
Report a cyber incident
Who to contact for cyber crimes: Report Fraud (England, Wales, NI), Police Scotland, and the NCSC.
-
Document everything
Record the breach in your breach register - even if you did not report to the Commission. Document: what happened, who was affected, your decisions, and actions taken. The Commission can audit your records.
-
After the crisis: review and improve
Once contained, conduct a post-incident review. Identify what went wrong and update your security measures.
Full data breach response guide
Detailed guidance on the complete breach response process, including when you do and do not need to notify, what to tell affected individuals, and preparing for future incidents.