A data breach puts customer trust, business operations, and regulatory compliance on the line. A compromised Microsoft 365 account, an email sent to the wrong recipient, or an exposed database can leave a UK business dealing with sensitive data loss and legal reporting obligations. Getting ICO data breach reporting right means knowing when to report, meeting the 72-hour deadline, and taking control of the response from the outset.
Under UK GDPR, businesses must report a personal data breach to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, where feasible, if the breach is likely to pose a risk to individuals’ rights and freedoms. Breaches likely to result in a high risk to individuals also require direct communication with those affected. A clear reporting process helps businesses meet these obligations, maintain proper incident records, and limit disruption while protecting their reputation and customer relationships.
What Is ICO Data Breach Reporting?
ICO data breach reporting is the process of notifying the UK regulator about a personal data breach that meets the legal reporting threshold. The requirement applies to organisations acting as data controllers under UK GDPR, including businesses that collect, store, use or manage personal information.
A personal data breach occurs when a security incident causes the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It covers confidentiality, integrity and availability incidents, not only cyberattacks.
Common examples include:
- Misdirected emails: An employee sends a customer database or payroll spreadsheet to the wrong recipient.
- Unauthorised account access: A criminal gains access to a business email account, cloud storage or customer management system.
- Lost devices: A laptop or mobile phone containing personal information goes missing.
- Exposed databases: Incorrect access permissions make customer or employee records available to unauthorised users.
- Ransomware incidents: Attackers encrypt business records or steal personal data from company systems.
- Accidental deletion: Personal information is destroyed or becomes unavailable because of human error or a technical failure.
What Is the 72-Hour Data Breach Rule?
The 72-hour data breach rule under UK GDPR sets the reporting timeframe for personal data breaches that meet the notification threshold.
A controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach. The organisation must act promptly rather than treating the entire 72-hour period as time available for investigation.
When Does the 72-Hour Clock Start?
The reporting clock starts when the organisation has a reasonable degree of certainty that a personal data breach has occurred. The deadline does not automatically begin when the attacker first enters a system if the organisation has not yet discovered the incident.
For example, a business discovers suspicious activity in a staff email account. Its investigation confirms that an unauthorised person accessed emails containing customer information. Once the organisation has sufficient certainty that personal data has been compromised, it must assess the reporting requirement and act promptly.
The business does not need to establish every detail before making that decision. If the breach is reportable but the investigation remains incomplete, it must submit the available information within the required timeframe and provide further details later without undue delay.
Does Every Personal Data Breach Need to Be Reported?
No. The decision depends on the likely risk to individuals’ rights and freedoms.
- No likely risk: The organisation does not need to notify the ICO under the UK GDPR breach-reporting rule, but it must document the breach and explain why notification was unnecessary.
- Likely risk: The organisation must notify the ICO without undue delay and, where feasible, within 72 hours.
- Likely high risk: The organisation must also inform affected individuals without undue delay, subject to the applicable legal exceptions.
How to Report a Data Breach to the ICO
Businesses can report a notifiable personal data breach through the ICO’s official online service. The process begins with containment and assessment, followed by notification and any necessary follow-up action.
Step 1: Contain the Incident
Stop further unauthorised access or disclosure while preserving the evidence needed for the investigation.
For a compromised account, revoke unauthorised sessions, reset credentials and review account activity. For a misdirected email, contact the unintended recipient and request that the information is not accessed, shared or retained. For a lost device, assess available remote-locking or wiping options.
Step 2: Establish What Happened
Build a timeline of the incident and identify the personal data involved. Record when the event occurred, when the organisation discovered it, how the breach happened and which systems or records were affected.
Establish the categories of information involved, the approximate number of affected individuals and records, whether unauthorised access occurred, and whether the breach remains active.
Step 3: Assess the Risk to Individuals
Assess the likelihood and severity of harm arising from the breach. Consider the sensitivity of the information, the number of people affected, the possibility of misuse, and the circumstances of the exposure.
For example, the disclosure of ordinary business contact details may present a different risk from the exposure of identity documents, financial information, login credentials, or health records. Encryption, access restrictions, and the likelihood that an unauthorised person could use the information also influence the assessment.
Document the findings and the reason for the reporting decision. If the breach is likely to create a risk to individuals’ rights and freedoms, notify the ICO. If the risk is unlikely, record the justification for not reporting.
Step 4: Submit the ICO Notification
Use the ICO’s official data breach reporting service to submit the notification.
The organisation needs to explain what happened, when it became aware of the breach, who was affected, the likely consequences and the measures taken or planned to address the incident. It must also provide contact details for follow-up questions.
Do not wait for a complete forensic investigation if the breach meets the reporting threshold. Submit the information available within the deadline and provide additional details as soon as possible.
Step 5: Complete Follow-Up Actions
Continue investigating the incident, reducing the risk to affected individuals and addressing the cause of the breach. Provide further information to the ICO without undue delay.
Depending on the circumstances, the response might include notifying affected individuals, restoring data, reviewing access permissions, fixing technical weaknesses, and updating internal procedures.
Maintain the incident log, risk assessment, notification records, and corrective-action evidence. These records demonstrate how the organisation responded and support future improvements.
ICO Breach Notification Checklist
A structured checklist helps businesses collect the information required for a reporting decision and prepare an accurate ICO notification.
Before submitting the report, confirm that you have:
- Recorded when the breach occurred and when the organisation became aware of it.
- Identified the personal data, systems and individuals affected.
- Estimated the number of affected individuals and personal data records.
- Contained the breach and preserved relevant evidence.
- Assessed the likelihood and severity of harm to individuals.
- Documented the decision to notify or not notify the ICO.
- Prepared a description of the incident and its likely consequences.
- Recorded the containment measures and planned corrective actions.
- Provided contact details for the person handling the incident.
- Submitted the required notification within the deadline, where feasible.
- Prepared to provide further information if the investigation remains ongoing.
- Assessed whether affected individuals need direct notification.
The checklist supports the response process but does not replace a case-specific assessment. Businesses can also use the ICO’s personal data breach guidance and its breach self-assessment tool.
What Information Must an ICO Data Breach Report Include?
A notification needs enough detail for the ICO to understand the incident, assess its consequences, and determine whether further action is appropriate.
Under UK GDPR, the required information includes:
Nature of the breach: Explain what happened, how the incident occurred and the categories of personal data involved.
People and records affected: Provide the approximate number of individuals concerned and personal data records involved, where possible.
Contact details: Identify the data protection officer, where the organisation has one, or another contact who can provide further information.
Likely consequences: Explain the potential impact on affected individuals, including the possibility of financial loss, identity theft, discrimination or loss of confidentiality.
Containment and mitigation: Describe the measures already taken and the actions planned to address the breach and reduce its effects.
The organisation must provide accurate information and distinguish confirmed findings from estimates. When some details remain unavailable, submit the information that is ready and provide outstanding details later without undue delay.
Do Businesses Have to Notify Affected Individuals?
ICO notification and communication with affected individuals are separate legal obligations.
A business must notify the ICO when a personal data breach is likely to pose a risk to individuals’ rights and freedoms. It must also communicate directly with affected individuals without undue delay when the breach is likely to result in a high risk to those rights and freedoms, unless a relevant legal exception applies.
For example, a breach involving identity documents, financial information or login credentials could expose individuals to fraud or account takeover. In such cases, the organisation needs to assess whether direct communication is required and explain what happened, the likely consequences and the steps individuals can take to protect themselves.
What Happens If a Business Misses the 72-Hour Deadline?
Missing the deadline does not remove the obligation to report a notifiable breach. The business must notify the ICO without further undue delay and explain why the report was late.
An incomplete investigation is not a reason to postpone a required notification. The organisation can submit the available information first and provide further details as the investigation progresses.
Failure to meet data protection obligations can lead to regulatory scrutiny and enforcement action. The ICO considers the circumstances of the breach, the organisation’s compliance and the response taken. A prompt, documented response helps demonstrate accountability, but it does not guarantee that enforcement action will not follow.
Businesses also need to consider whether the incident requires notification to other relevant parties, such as an insurer, law enforcement or the National Cyber Security Centre. These notifications serve different purposes and do not replace any required ICO report.
How UK Businesses Can Prepare for Data Breach Reporting
A reporting process is most effective when responsibilities are agreed before an incident occurs. Businesses that rely on improvised decisions during a breach risk losing valuable time and overlooking important obligations.
Assign Responsibility for Incident Response
Nominate a person or team to coordinate breach assessment and reporting. Depending on the organisation, this responsibility might sit with a data protection officer, privacy lead, compliance manager or another designated employee.
Employees need a clear route for escalating suspected incidents. Staff should know who to contact when they send information to the wrong recipient, discover suspicious account activity or identify exposed records.
Set Internal Reporting Deadlines
The legal 72-hour deadline applies to the controller’s notification obligation. Internal reporting procedures need to give the responsible team enough time to investigate, assess risk and submit the report.
Require staff to report suspected breaches immediately. Establish escalation routes for evenings, weekends and public holidays so that an incident does not remain unattended while the deadline approaches.
Maintain an Incident Register
Record all personal data breaches, including those that do not require ICO notification. Each record needs the incident details, risk assessment, reporting decision, containment measures and follow-up actions.
A consistent incident register helps management identify recurring issues, such as misdirected emails, excessive access permissions or weaknesses in supplier arrangements. It also provides evidence of how the organisation met its accountability obligations.
Review Supplier Reporting Arrangements
When a third-party processor experiences a personal data breach, it must inform the relevant controller without undue delay. The controller then assesses whether notification to the ICO is required.
Contracts and operating procedures need to define how suppliers report incidents, what information they provide and how quickly they escalate suspected breaches. Clear arrangements help the controller act within its own reporting timeframe.
Test the Response Plan
Run practical exercises involving compromised accounts, ransomware, lost devices and accidental disclosures. Test how quickly staff escalate incidents, how the responsible team assesses risk and how management approves reporting decisions.
Use the findings to improve procedures, staff training and security controls. Review the response plan after real incidents and significant changes to systems or business operations.
How Cybersecurity Services UK Supports Data Breach Preparedness
Businesses need technical safeguards and a clear incident response process to manage data breaches effectively. Security controls help reduce the likelihood of incidents, while documented procedures help the organisation respond when personal information is compromised.
Cybersecurity Services UK supports businesses with security assessments, incident response planning and improvements to information security controls. This work helps organisations identify weaknesses, establish responsibilities, and prepare for incidents involving unauthorized access or disclosure.
Specialist support can help the response team investigate the incident, preserve relevant evidence, assess security weaknesses, and organize corrective actions. The business remains responsible for its legal reporting decisions and for notifying the ICO when the applicable threshold is met.
Meet ICO Data Breach Reporting Requirements
ICO data breach reporting requires UK businesses to identify personal data breaches, assess the risk to individuals and act within the applicable reporting timeframe. The 72-hour rule applies to notifiable breaches, and organisations must report without undue delay rather than wait for every investigative detail.
Establish an incident response procedure, assign reporting responsibilities, maintain an incident register and give employees a clear route for escalating suspected breaches. Assess whether affected individuals need direct notification, preserve evidence and address the weaknesses that contributed to the incident.
Cybersecurity Services UK helps businesses strengthen security controls and prepare incident response procedures. A defined reporting process gives your team a practical way to respond to personal data breaches, meet its legal obligations and protect the people whose information the business handles.
FAQs
How long do UK businesses have to report a data breach to the ICO?
For a notifiable personal data breach under the UK GDPR, the organisation must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If notification is late, it must explain the delay.
Do I Need to Report a Data Breach to the ICO?
You must report a personal data breach to the ICO if it is likely to pose a risk to individuals’ rights and freedoms. Under UK GDPR, you must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Does the 72-hour data breach rule apply to every security incident?
No. The rule applies to notifiable personal data breaches. If a personal data breach is unlikely to create a risk to individuals’ rights and freedoms, the organisation does not need to report it to the ICO under the UK GDPR reporting rule. It must still record the breach and document its decision.
How do I report a data breach to the ICO?
Use the ICO’s online reporting service. Provide the available information about the incident, the people and records affected, the likely consequences, the containment measures and the relevant contact person. Submit the required notification within the deadline and provide further details without undue delay.
What happens if a business discovers a breach after 72 hours?
The organisation must act promptly, submit the required notification without further undue delay and explain why it missed the deadline. It must also continue its investigation, assess the impact on individuals and complete any required communications and corrective actions.
Do businesses have to notify customers as well as the ICO?
A business must inform affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, subject to applicable exceptions. ICO notification and communication with affected individuals are separate obligations.
What records should a business keep after a personal data breach?
Keep the incident timeline, details of the personal data involved, the risk assessment, the decision to notify or not notify the ICO, copies of reports and communications, containment measures and corrective actions. These records demonstrate accountability and support future improvements.