How to Report a Data Breach to the ICO: A Complete UK Guide

A personal data breach is stressful, time-sensitive, and governed by strict UK GDPR rules. If you are a business, charity, or sole trader processing personal data, you may have a legal duty to report a data breach to the ICO within 72 hours. If you are an individual whose data has been exposed, you have the right to be told — and the right to act quickly to protect yourself.

This guide walks you through exactly how to report a data breach to the ICO, what the Information Commissioner's Office expects, how to decide if a breach is notifiable, and how Lunyb helps you detect breaches early, assess the damage, and lock down exposed accounts before harm spreads.

What counts as a personal data breach under UK GDPR

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is not only about hackers — a lost laptop, a misaddressed email, or a staff member viewing records they shouldn't can all qualify.

The ICO groups breaches into three types:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
• Integrity breach — unauthorised or accidental alteration of personal data.
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data.

You may have one type or several at once. A ransomware attack, for example, often hits all three.

Examples of reportable breaches

• An email with a customer spreadsheet sent to the wrong recipient.
• A database left exposed on the public internet without authentication.
• A stolen work phone that is not encrypted.
• Payroll records emailed to staff with hidden columns that reveal salaries.
• A phishing attack that compromises staff mailboxes containing client data.

Do you actually have to report the breach to the ICO?

Not every breach is notifiable. Under UK GDPR, you must report a breach to the ICO when it is likely to result in a risk to the rights and freedoms of individuals. If the risk is high, you must also tell the affected individuals.

Ask yourself three questions:

1. What data is involved? Special category data (health, biometric, political views) and financial data carry higher risk.
2. How many people are affected? Volume increases the potential harm.
3. What is the realistic impact? Could it lead to identity theft, fraud, discrimination, financial loss, reputational damage, or physical safety concerns?

If the answer points to meaningful risk, report it. If you genuinely conclude there is no risk — for example, a properly encrypted device is lost and no one can access the data — you must still record the decision internally, but you do not need to notify the ICO.

The 72-hour rule

You have 72 hours from becoming aware of the breach to report it. "Aware" means you have a reasonable degree of certainty that a security incident has occurred that led to personal data being compromised. The clock includes weekends and bank holidays.

If you cannot provide all the information within 72 hours, report what you know and provide the rest in phases. Late reporting is better than no reporting, but you must explain the delay.

How to report a data breach to the ICO: step by step

Here is the exact process the ICO expects organisations to follow.

1. Contain the breach. Stop the leak. Revoke access, reset passwords, isolate affected systems, recall the email if possible.
2. Assess the risk. Identify what data, how many people, and what the likely consequences are.
3. Record the breach. Keep an internal log even if you decide not to notify the ICO.
4. Report to the ICO within 72 hours if notifiable. Use the ICO's online self-assessment and reporting tool at ico.org.uk, call the ICO helpline on 0303 123 1113, or send a report by post if needed.
5. Notify affected individuals if the risk to them is high. Use clear, plain English — explain what happened, what data is involved, what you are doing, and what they should do.
6. Investigate and remediate. Fix the root cause, update policies, retrain staff, patch systems.
7. Review and learn. Update your incident response plan so the same breach cannot happen twice.

Information the ICO will ask for

• A description of the nature of the breach.
• The categories and approximate number of individuals affected.
• The categories and approximate number of personal data records concerned.
• The name and contact details of your Data Protection Officer or breach contact.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate harm.

What happens after you report a data breach to the ICO

The ICO reviews your report and decides whether further action is needed. Outcomes range from no further action, to advice and recommendations, to a formal investigation, to enforcement notices and fines. Fines under UK GDPR can reach up to £17.5 million or 4% of annual global turnover, whichever is higher — though in practice the ICO reserves the largest penalties for serious, systemic failures.

Cooperating fully, reporting on time, and showing you had reasonable safeguards in place almost always leads to better outcomes.

What individuals should do if their data has been breached

If you have been told by a company that your data was caught in a breach — or you spotted it yourself in news coverage — you are not powerless. Act in the first 24–48 hours and you dramatically cut the odds of fraud.

1. Change the password on the affected account and anywhere you reused it.
2. Turn on two-factor authentication — preferably an authenticator app, not SMS.
3. Check your email and phone number against breach databases to see every service where your data has leaked.
4. Watch for phishing. Criminals use breach data to craft convincing scam messages within days.
5. Monitor your bank and credit file for unexpected activity. Consider a free credit freeze with the UK credit reference agencies.
6. Complain to the ICO at ico.org.uk/make-a-complaint if the organisation handled the breach badly or ignored you.

How Lunyb helps you detect, assess, and respond to data breaches

Reporting a breach is only half the job. The harder part is knowing a breach has happened in the first place, understanding your exposure, and locking down the fallout. That is exactly what Lunyb is built for — and it is why we recommend it as the practical next step after reading this guide.

Data Breach Alerts for your email and phone

Lunyb continuously checks your email addresses and phone numbers against known breach sources. When your data appears in a new leak, you get an alert telling you which service was breached, what data was exposed, and what to change first. No more discovering a breach months later when your bank card gets cloned.

Scam Checker and Scam Shield

Breach data fuels phishing. Lunyb's Scam Checker lets you paste a suspicious message or link to get an instant risk read, and Scam Shield helps block fraud calls before they reach you. If your phone number leaked in a breach, these tools are the difference between a nuisance and a successful scam.

Privacy Check and Security Score

Our Privacy Check reviews the permissions apps have on your phone — microphone, location, contacts, photos — and flags over-reach. Your Security Score tracks your overall posture in one place, so you can see improvement as you harden accounts after a breach.

Encrypted Password and Photo Vault

A breach is the perfect reason to stop reusing passwords. Lunyb's encrypted vault stores unique logins and sensitive photos locally and securely, so one leaked site cannot cascade into all of them. Combined with our browsing-history eraser and on-device tracker and threat blocking via a local DNS shield, you cut off the main channels attackers exploit after a breach.

Photo Guard and data-broker exposure help

If photos of you are circulating where they shouldn't be, Photo Guard runs reverse-image checks. And our data-broker exposure help walks you through reducing the trail of personal information sites that aggregators resell — a major source of secondary breach risk.

Why Lunyb beats stitching this together yourself

Lunyb plans start from about £19.99 / $19.99 per month, renew until cancelled, and can be cancelled anytime online. Optional Leak Protection is billed separately and can be paused without cancelling the main plan — no awkward downgrade calls. If you want a deeper look at how we operate, see our honest review of Lunyb.

A practical 72-hour checklist for organisations

1. Hour 0–2: Confirm the incident. Contain. Preserve logs.
2. Hour 2–12: Scope the breach. Identify data types, systems, and numbers affected.
3. Hour 12–24: Risk-assess against UK GDPR criteria. Decide: notify ICO? Notify individuals?
4. Hour 24–48: Draft and submit the ICO report via ico.org.uk. Prepare individual notifications in plain English.
5. Hour 48–72: Send individual notifications where required. Publish a holding statement if media attention is likely.
6. Day 3+: Remediate root cause, update your record of processing, retrain staff, update your breach register.

Common mistakes when reporting a breach to the ICO

• Waiting until you have all the facts. Report what you know in 72 hours and update later.
• Under-reporting scope. If in doubt about numbers, give a range and explain.
• Vague victim notifications. Tell people what data, what risk, and what to do — specifically.
• No internal breach log. The ICO expects records of all breaches, even the ones you decide not to report.
• No follow-through. If you don't fix the root cause, the next breach will be treated as a pattern.

Take the next step with Lunyb

Reporting a breach is a legal process. Preventing the next one — and limiting the damage from the last one — is a practical one. Lunyb gives you the breach alerts, scam defences, encrypted vault, and privacy tools to do both.

Start at lunyb.com, take the free privacy quiz to see your current exposure, and download the Lunyb app on the App Store or Google Play to turn on breach alerts, Scam Shield, and your Security Score today.

FAQ

How quickly must I report a data breach to the ICO?

Within 72 hours of becoming aware of the breach. The clock includes weekends and bank holidays. If you can't provide all details in time, submit an initial report and add information in phases.

Do I have to tell affected individuals as well as the ICO?

Only if the breach is likely to result in a high risk to their rights and freedoms. If so, notify them directly in clear, plain language without undue delay. If direct contact would require disproportionate effort, a public communication is acceptable.

What if I decide a breach is not notifiable?

You still have to document it. Keep a record of the facts, your risk assessment, and your reasoning. The ICO can ask to see your breach register at any time.

Can individuals report an organisation to the ICO?

Yes. If a company fails to tell you about a breach, mishandles your data, or ignores your complaint, you can raise a concern at ico.org.uk/make-a-complaint. The ICO does not award compensation but can take enforcement action.

How does Lunyb help after a breach?

Lunyb's Data Breach Alerts tell you when your email or phone appears in a new leak, Scam Checker and Scam Shield defend against the phishing that follows, and the encrypted password vault lets you reset exposed logins with unique credentials. Start at lunyb.com.