Do I need to report a breach to the ICO?

First, is it a personal data breach?

A personal data breach is anything that means personal data is lost, destroyed, changed, or seen by someone who shouldn't see it. That's much wider than being hacked. It includes:

• A mailbox taken over by a criminal, who can now read years of customer and staff emails.
• Ransomware, even if nothing was copied, because people's data was unavailable.
• An email or spreadsheet sent to the wrong person.
• A lost or stolen laptop or phone.
• A shared link to a folder of client files that anyone could open.

Personal data means anything that identifies a living person: names, emails, addresses, bank details, ID documents, HR records, health information.

The 72-hour clock

Under UK GDPR, if a breach has to be reported you must tell the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it. The clock starts when you're reasonably sure a breach has happened, not when you've finished investigating, and weekends count.

You don't need every answer before you report. The ICO expects an initial report within 72 hours, with more detail added as you find it. Reporting late is worse than reporting early with gaps.

How to decide whether to report

The test is risk to the people whose data it is. Ask: is this breach likely to result in a risk to their rights and freedoms? Think about fraud, identity theft, financial loss, embarrassment, discrimination or distress.

• If a risk is likely, report it to the ICO.
• If a risk is unlikely, you don't have to report it, but you must record it and why you decided not to.
• If the risk is high, you must also tell the people affected.

Probably needs reporting

• A hacked mailbox containing customer bank details, invoices or ID documents.
• Ransomware where the attackers copied data before encrypting it.
• Staff HR or payroll files emailed to the wrong person outside the business.
• A lost laptop with client data that wasn't encrypted.

Probably doesn't

• A lost laptop that was encrypted, with a strong password, and wiped remotely.
• An email with one business contact's work details sent to the wrong colleague at the same client, who confirmed they deleted it.
• A short outage where you restored from backup and there's no sign anything was copied.

Every case turns on its details. If you're unsure, the ICO's view is that it's better to report.

Telling the people affected

When the risk to people is high, tell them directly and without undue delay. Use plain language: what happened, what data was involved, what you're doing about it, and what they should do now, such as watching for scam emails or calls, changing a password, or checking bank statements. Give them a named person to contact.

What to put in the report

You can report online through the ICO website. Have this ready:

1. What happened, when, and how you found out.
2. What kinds of personal data were involved, and roughly how many people and records.
3. The likely consequences for those people.
4. What you've done to contain it, and what you're doing to stop it happening again.
5. Whether you've told the people affected, or why not.
6. A contact for the ICO to follow up with.

Keep a record of every breach

UK GDPR says you must keep a record of every personal data breach, including the ones you don't report: the facts, the effects and what you did about it. If the ICO ever asks, a written reason for not reporting is what shows you took it seriously. A simple log is enough for most businesses.

Who else to call

• Your cyber insurer. Many policies need to be told straight away, and some provide an incident response team. Check before you do anything else.
• Your bank, at once, if money has moved or bank details may have been used.
• The police, through Report Fraud (which replaced Action Fraud), if it's a crime such as fraud or extortion.
• Your customers or partners, if your contracts say you must tell them about breaches.

What happens if you don't report

Failing to report a notifiable breach can bring a fine of up to £8.7 million or 2% of global turnover, separate from any fine for the breach itself. The ICO does use this. It fined DPP Law £60,000 after a cyber attack, finding among other things that the firm reported too late.

In practice, the ICO is usually far more interested in whether you acted quickly and sensibly than in punishing a business that's just been attacked. Reporting promptly, and being able to show what you did, works in your favour.

A note on the rules

The ICO is reviewing its guidance after the Data (Use and Access) Act 2025, but the 72-hour rule for UK GDPR breaches hasn't changed. For the official wording, see the ICO's guide to personal data breaches.

If a breach has come from a cyber incident, my guides on a hacked business email account and a ransomware attack cover the first hour, and through my cyber incident response I can help you work out what was accessed, which is exactly what the ICO will ask.