Data Breach Response: Notify the ICO Within 72 Hours
A misdirected email, a stolen laptop or a hacked inbox can all be personal data breaches. Under UK GDPR, the clock starts the moment you become aware, and you may have just 72 hours to report to the ICO. This playbook gives UK small businesses a step-by-step plan for the first three days, with notes for EU readers.
Key takeaways
- Report a personal data breach to the ICO within 72 hours of becoming aware, unless it is unlikely to result in a risk to people's rights and freedoms.
- Tell affected individuals without undue delay if the breach is likely to result in a high risk to them.
- Record every breach internally, including the ones you decide not to report.
- You can report in stages: send what you know within 72 hours and add details later.
- In the EU, the same 72-hour rule applies, with your national supervisory authority.
Most people picture a data breach as a dramatic hack. In reality, many small business breaches are ordinary mistakes: an invoice emailed to the wrong customer, a spreadsheet of staff details shared with the wrong link settings, or a phone without a passcode left in a taxi. UK GDPR defines a personal data breach broadly, as a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
That means breaches cover confidentiality (someone saw data they should not have), integrity (data was changed without permission) and availability (data was lost or locked, for example by ransomware). Not every breach must be reported, but every one must be assessed and recorded.
This playbook is general information, not legal advice. The ICO's guidance and reporting form are the authority on what you must do, and a qualified adviser or your cyber insurer can help with serious incidents. For handling the technical side of a cyber attack, see our checklist on the first hour after an attack; this article focuses on the data protection duties.
The 72-hour rule, in plain terms
Three details about the deadline are often misunderstood:
- It is 72 hours, not three working days. Weekends and bank holidays count. A breach discovered on Friday afternoon may need reporting by Monday afternoon.
- "Aware" means reasonably certain. You become aware when you have a reasonable degree of certainty that a security incident has compromised personal data. A brief investigation to confirm is fine; deliberately not looking is not.
- You can report in phases. If you do not have all the facts within 72 hours, report what you know, explain why details are missing, and send updates as your investigation continues.
Common mistake
Waiting until you understand everything before reporting. The ICO expects an initial report within the deadline even if the picture is incomplete. A late but perfect report is worse than a timely partial one.
The playbook: hour by hour
Print this section and keep it with your incident contacts. When a breach happens, follow the steps in order and keep a written log with times.
Hours 0 to 4: contain and record
- Start a log. Note the time you found out, who told you, and what you know. Add every action and decision with a timestamp from now on.
- Contain the breach. Recall or ask the recipient to delete a misdirected email, revoke a shared link, lock or remotely wipe a lost phone if your device policy allows, or reset compromised passwords from a clean device. For a cyber attack, isolate affected devices from the network but do not wipe or power them off before taking advice, so evidence is kept.
- Call for help. Contact your IT provider and, if you have cyber insurance, your insurer's incident hotline. Many policies require early notification.
- Assign an owner. Name one person to lead the response and keep the 72-hour clock in view.
Hours 4 to 24: understand what happened
- Identify the data. What types of personal data were involved: names, contact details, financial information, health data, ID documents, passwords?
- Count the people. Roughly how many individuals and records are affected? Are they customers, staff, children or vulnerable people?
- Work out the cause. Human error, theft, a cyber attack, a supplier failure? Was the data encrypted?
- Check suppliers. If a processor, such as a payroll provider or cloud service, holds the data, contact them and ask for their findings in writing.
Hours 24 to 72: assess risk, decide and report
- Assess the risk to people. Use the questions in the next section to judge the likelihood and severity of harm.
- Decide whether to report. Unless the breach is unlikely to result in a risk to people's rights and freedoms, report it to the ICO.
- Report. Use the online report form on ico.org.uk, or call the ICO helpline on 0303 123 1113 during opening hours.
- Decide whether to tell individuals. If the risk to them is high, tell them without undue delay.
- Record your reasoning. Whatever you decide, write down why.
How to judge whether a breach is reportable
The test is about the risk to people, not the embarrassment to your business. Ask yourself what could realistically happen to the individuals because of this breach, and how serious it would be. Consider:
- Type of data. Health, financial, identity documents, passwords and data about children carry more risk than a business email address.
- Volume. More people and more data generally means more risk, though one sensitive record can be enough.
- Who has it. A trusted client who confirms deletion is very different from an unknown criminal.
- Protection. Properly encrypted data with a secure key is far less risky than plain files.
- Possible harm. Identity theft, fraud, financial loss, discrimination, distress, damage to reputation or physical harm.
| Scenario | Likely risk | Typical outcome |
|---|---|---|
| Newsletter sent with all addresses in CC instead of BCC, to a small list of trade contacts | Low to moderate | Record; consider reporting depending on the list and context |
| Encrypted laptop lost, key not compromised | Unlikely to be a risk | Record; usually no report |
| Staff payslips emailed to the wrong employee | Risk to individuals | Record and likely report to the ICO |
| Ransomware encrypts and steals customer records | High | Report to the ICO and tell affected people |
| Hacked inbox containing ID documents and bank details | High | Report to the ICO and tell affected people |
These are illustrations, not rules. The ICO website has a self-assessment tool that helps you decide; if you are unsure, many organizations choose to report and explain their reasoning.
Example
Imagine a made-up physiotherapy clinic, Northgate Physio, where a receptionist emails a patient's treatment notes to the wrong patient with a similar name on a Thursday. She tells the practice manager within the hour. The manager logs the time, phones the recipient, who agrees to delete the email and confirms in writing, and assesses the risk. Because health data is involved, the clinic reports to the ICO on Friday, tells the affected patient that day, and books refresher training on checking recipients.
What to tell the ICO and affected people
Your ICO report
The ICO's form asks for the essentials. Have these ready, even if some are estimates:
- What happened, when it happened and when you found out
- The categories and approximate number of people and records affected
- The likely consequences for those people
- What you have done, or plan to do, to contain the breach and reduce harm
- A named contact person
- If you are late, why
Telling individuals
When the risk to people is high, tell them without undue delay, in clear and plain language. Your message should explain what happened, what data was involved, the likely consequences, what you are doing about it, what they can do to protect themselves (such as watching for phishing or changing passwords) and who to contact for questions.
Pro tip
Draft a breach notification template now, while you are calm. Fill in the blanks on the day instead of writing from scratch under pressure. Keep it short, honest and free of jargon, and avoid language that minimizes the impact.
Other people you may need to tell
Depending on the breach, you may also need to contact your bank, your insurer, the police (through Report Fraud on 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101), or other regulators for your sector. If you are a processor handling data for another business, tell that business (the controller) without undue delay so it can meet its own deadline.
Record every breach and learn from it
UK GDPR requires you to keep a record of all personal data breaches, whether or not you report them. A simple breach log can be a spreadsheet with these columns: date found, date occurred, description, data and people affected, risk assessment, whether reported to the ICO (and why or why not), whether individuals were told, and actions taken.
After the dust settles, hold a short lessons-learned review. Ask what allowed the breach to happen and what single change would make it less likely. Common fixes for small businesses include turning on email recipient warnings, using BCC by default for group sends, encrypting all laptops, tightening link-sharing settings and adding MFA to email.
Your breach-readiness checklist
- Name a breach lead and a deputy
- Save the ICO helpline 0303 123 1113 and the report form location
- Keep your IT provider and insurer contacts somewhere you can reach without email
- Create a breach log spreadsheet
- Draft notification templates for the ICO and individuals
- Know where your personal data is stored and which suppliers hold it
- Encrypt laptops and phones to reduce the risk if one is lost
- Train staff to report possible breaches immediately and without blame
Frequently asked questions
Do I have to report every data breach to the ICO?
No. You must report unless the breach is unlikely to result in a risk to people's rights and freedoms. You must still record every breach and your reasons for not reporting.
What if I miss the 72-hour deadline?
Report as soon as you can and explain the reasons for the delay. Do not let a missed deadline stop you reporting at all, which would make things worse.
Is sending an email to the wrong person really a breach?
Yes, if it contains personal data. Whether it needs reporting depends on the data and the risk, so assess it and record it either way.
How does this work for businesses in the EU?
EU GDPR has the same 72-hour rule. Report to the national supervisory authority in the country where you are established, and check its own guidance and forms.
Related reading
The bottom line
A data breach is stressful, but the duties are clear: contain it, log everything, assess the risk to people, report to the ICO within 72 hours unless the risk is unlikely, tell individuals if the risk is high, and record every breach. Preparing a breach lead, a log and templates now turns a crisis into a checklist.
Rules and guidance change, so check the ICO website and speak to a qualified adviser or your insurer when a breach is serious.
