A data breach can begin with a misdirected email, a lost laptop or a compromised customer database. For UK businesses, the urgent question is whether the incident threatens people and triggers a legal reporting duty. Not every security incident must be reported, but failing to recognise a reportable breach can create additional problems.
Under the UK GDPR, certain personal data breaches must be notified to the Information Commissioner’s Office (ICO), generally within 72 hours of awareness. High-risk incidents may also require direct notification to affected people. The key is to act quickly while making an evidence-based assessment.
What qualifies as a personal data breach?
A personal data breach involves accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It covers confidentiality, integrity and availability, not only cyberattacks.
Examples include sending customer details to an unintended recipient, unauthorised access to employee records, accidentally deleting data without a usable backup, or ransomware making important personal records unavailable. A security incident that does not affect personal data may fall outside these particular reporting rules.
When must a UK business notify the ICO?
Under Article 33, a controller must notify the ICO unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. The decision is based on likely harm to people, not just financial loss or reputational damage to the company.
Consider the sensitivity of the information, how many people could be affected, who obtained access, whether the data is intelligible and the possible consequences. These might include identity theft, financial loss, discrimination, distress or exposure of confidential matters. Strong encryption or confirmed containment can reduce risk, but the business needs evidence.
The three reporting outcomes
Where risk to people is unlikely, ICO breach reporting is generally unnecessary, although the incident must be recorded. Where risk is likely, the ICO must be notified. Where high risk is likely, the affected people must generally be informed as well. A breach affecting only one person can still meet either threshold.
How does the 72-hour deadline work?
A reportable data breach UK businesses encounter must be notified without undue delay and, where feasible, within 72 hours of becoming aware of it. This is 72 hours, not three working days. The business should record when it had a reasonable degree of certainty that personal data had been compromised.
Do not wait for a complete forensic investigation or an exact record count. The ICO encourages businesses to report early and update later. Submit the reliable facts available, identify unknown details and provide additional information in phases without undue further delay. If reporting takes longer than 72 hours, explain why.
What information must the ICO receive?
An Article 33 notification must describe the nature of the breach and, where possible, the categories and approximate numbers of affected individuals and personal data records. It must identify a data protection officer or other contact point, outline likely consequences and explain measures taken or proposed to deal with the incident and reduce harm.
The ICO’s online form also asks how the organisation learned of the breach, which people may be affected and whom else it has informed. Separate established facts from estimates, retain a copy of the notification and keep the case reference for follow-up.
Example: customer details sent to the wrong supplier
Suppose a small online retailer emails a spreadsheet containing names, addresses and order histories to an external supplier that should never have received it. Staff should immediately contact the recipient, request secure deletion, check whether the file was forwarded and preserve evidence of what happened.
If a trusted recipient confirms prompt deletion and there is persuasive evidence of no further disclosure, risk might be unlikely. If the recipient is unknown, refuses to cooperate or the orders reveal sensitive information, the assessment changes. The retailer should not automatically assume either that every misdirected email is reportable or that recalling an email eliminates the risk.
When must affected individuals be notified?
Under Article 34, if a personal data incident is likely to result in a high risk to people’s rights and freedoms, the controller must generally tell those affected without undue delay. This is a separate requirement from the ICO’s 72-hour deadline.
People should receive a clear explanation of what happened, a contact point, likely consequences and the protective steps the business has taken. Where appropriate, suggest practical actions such as changing compromised passwords, watching for phishing emails or contacting their bank.
Limited exceptions can apply, including where effective encryption made exposed data unintelligible, subsequent measures removed the high risk, or direct contact would involve disproportionate effort. The last circumstance may require an equally effective public communication. Document the basis for relying on an exception.
Keep records even when no report is required
Article 33(5) requires controllers to document every personal data breach, including its facts, effects and remedial actions. A useful breach register records dates, affected systems, data categories, the risk assessment, reporting decisions, responsible people and evidence supporting those decisions.
This also makes recurring weaknesses easier to spot. Review training, access permissions and email safeguards after each incident. An internal UK GDPR compliance checklist, an incident response plan and a staff data protection policy are useful companion resources.
What if a processor discovers the breach?
A processor, such as a payroll provider handling data on a customer’s instructions, must notify the controller without undue delay after becoming aware of a personal data breach. The controller normally makes the ICO reporting decision. Contracts should establish prompt escalation and information-sharing arrangements.
Sector-specific rules may add requirements. Public electronic communications providers, for example, use the relevant PECR breach reporting process, whose deadline was aligned to 72 hours by changes introduced in 2025. Some other regulated services have separate deadlines and notification routes.
Frequently asked questions
Do all breaches have to be reported to the ICO?
No. Notification is generally unnecessary if risk to individuals is unlikely, but every personal data breach must still be documented and the decision justified.
Can we report without knowing the full impact?
Yes. Send accurate initial information within the deadline and provide further details without undue delay as the investigation continues.
Is there a minimum number of affected people?
No. One person’s sensitive data may be enough to create a reportable risk, while a larger incident may have a lower risk depending on its circumstances.
Who is responsible when a supplier is involved?
The controller is normally responsible for deciding whether to notify the ICO. A processor must promptly inform the controller and support its assessment.
Prepare before an incident happens
The most effective response starts before a breach. Assign an incident lead, make internal reporting easy, test your escalation process and keep a usable record template. When something goes wrong, contain the problem, assess harm to individuals, meet any notification duties and learn from the evidence. That is the practical foundation of meeting UK data breach reporting requirements.