Do I need to report a data breach to the ICO?
Not every breach, but the ones that put people at risk have to be reported within 72 hours. Here’s how to tell which is which.
Not always. You need to report a data breach to the ICO when personal data has been lost, stolen, seen by the wrong people or made unavailable, and that’s likely to put the people it’s about at risk. If it is, you have 72 hours from when you become aware of it. If it isn’t, you don’t report it, but you still write it down.
What counts as a personal data breach
It’s wider than a hack. The ICO’s examples include an email sent to the wrong person, a lost or stolen laptop or phone, someone accessing records they shouldn’t, data being changed without permission, and data becoming unavailable, for example after ransomware locks your files.
How to decide whether to report it
The question is the likely effect on the people whose data it is, not on your business. The ICO gives two ends of the scale: a stolen customer database that could be used for identity fraud should be reported, while losing a staff phone list normally wouldn’t need to be. Think about how sensitive the data is, how many people it covers, and whether it could lead to fraud, distress or embarrassment.
The ICO’s website has a short self-assessment tool if you’re unsure. If you decide not to report, write down why. You need to be able to justify that decision later.
The 72 hours
The clock starts when you become aware of the breach, not when you’ve finished investigating it. You don’t need every answer to report. The ICO lets you send what you know and add details as you find them, as long as you keep going. If you’re late, you must explain why.
Telling the people affected
That’s a separate, higher bar. If the breach is likely to put people at high risk, you must tell them directly and without undue delay, in plain language, with advice on how to protect themselves, such as watching for scam emails or changing a password.
FAQ
Our IT provider or software supplier had the breach. Who reports it?
If they hold the data on your behalf, they must tell you without undue delay, and you decide whether to report it to the ICO. It’s worth checking your contracts say how quickly they’ll let you know.
What happens if we don’t report a breach we should have?
The ICO says failing to report a notifiable breach can lead to a fine of up to £8.7 million or 2% of global turnover, on top of its other powers.
Do we need to keep a record of breaches we don’t report?
Yes. You must record every personal data breach: what happened, its effects and what you did about it, whether you reported it or not.
The easiest way to hit 72 hours is to decide now who makes the call. Name one person, make sure the team knows to tell them straight away, and keep the ICO’s reporting page bookmarked. If you know what data you hold and where, the risk question gets much quicker to answer.
Sources
More on this. See every guide and story on these topics, or follow Ashley on LinkedIn for a short post most days.
Ashley Adkins
Ashley runs fromIT, helping businesses across the UK respond to cyber incidents and get certified to Cyber Essentials and ISO 27001. More about Ashley.