How to Report a Data Breach to the ICO: A Step-by-Step Guide (2026)

If you're an organisation in the UK and personal data has been lost, stolen, or exposed, you may be legally required to report that breach to the Information Commissioner's Office (ICO) within 72 hours. Miss that window without good reason and you risk fines, regulatory scrutiny, and lasting reputational damage.

This guide walks you through exactly how to report a data breach to the ICO, when you must notify affected people, and what to do next to stop the same thing happening again. We're Lunyb — a privacy and scam-protection platform — and we built this guide so both small business owners and individuals who've been caught up in a breach know their next move. When the paperwork is done, we'll also show you how Lunyb helps you monitor for breach fallout and lock down your exposure in one place.

What counts as a personal data breach under UK GDPR?

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is broader than most people think — it is not just hackers.

Under the UK GDPR and the Data Protection Act 2018, examples include:

• A laptop, phone, or USB stick containing customer data being lost or stolen.
• An email containing personal data sent to the wrong recipient.
• Ransomware encrypting files that hold personal data.
• An unauthorised person gaining access to a database, CRM, or cloud drive.
• Paper records being thrown out without being shredded.
• A website misconfiguration that exposes customer details publicly.

If personal data is involved and confidentiality, integrity, or availability has been compromised, you're looking at a personal data breach — and the ICO reporting clock may already be ticking.

Do you always have to report it?

No. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. If the risk is low — for example, a single misdirected email that was recalled before being opened and contained no sensitive data — you may not need to report it. But you must still document it internally. The ICO can ask to see your breach log at any time.

The 72-hour rule: when the clock starts

The 72-hour window starts from the moment your organisation becomes aware of the breach — not when it happened, and not when you've finished investigating. "Aware" means you have a reasonable degree of certainty that a security incident has occurred that led to personal data being compromised.

If you can't provide all the information within 72 hours, that's fine — the ICO expects breach reports to be made in phases. Report what you know, flag it as incomplete, and provide the rest as soon as you can.

If you report later than 72 hours without a justified reason, you must explain the delay. Unjustified late reporting is itself a breach of UK GDPR.

Step-by-step: how to report a data breach to the ICO

Here is the exact process the ICO expects UK organisations to follow when a reportable personal data breach occurs.

1. Contain the breach. Stop the bleeding first. Revoke access, reset passwords, isolate affected systems, recall emails, or physically secure lost devices if possible.
2. Assess the risk. Work out what data was involved, how many people are affected, what harm could result (identity theft, financial loss, distress, discrimination), and whether individuals are at high risk.
3. Decide if the breach meets the reporting threshold. If there is likely risk to individuals, you must report to the ICO. If there is high risk, you must also notify the affected individuals directly.
4. Gather the key facts. Nature of the breach, categories and approximate number of individuals affected, categories and approximate number of records affected, likely consequences, and the measures taken or proposed.
5. Submit the report to the ICO within 72 hours. Use the ICO's online reporting tool at ico.org.uk, or call the ICO breach helpline on 0303 123 1113 if you need urgent guidance.
6. Notify affected individuals if risk is high. Use clear, plain language. Tell them what happened, what data was involved, what you're doing about it, and what they should do (reset passwords, watch for scams, check statements).
7. Record everything. Even breaches you decide not to report must be logged with the facts, your risk assessment, and your reasoning.
8. Review and improve. Investigate root cause, patch the gap, update policies, and retrain staff. The ICO looks at how you respond, not just that a breach happened.

Information the ICO will ask for

When you submit the online report, be ready to provide:

• Your organisation's name, sector, and size.
• Details of your Data Protection Officer or main contact.
• When the breach happened and when you became aware.
• The cause (cyber attack, human error, physical loss, etc.).
• What personal data was affected (names, emails, financial data, special category data, etc.).
• How many individuals and records are involved.
• Potential consequences for those individuals.
• Steps taken to contain the breach and protect people.
• Whether you have told, or plan to tell, the individuals affected.

When you must also tell the affected individuals

If the breach is likely to result in a high risk to the rights and freedoms of individuals, you must tell them directly, without undue delay. High-risk examples include leaks of passwords, financial details, health information, children's data, or anything that could enable identity theft, fraud, or targeted scams.

Your notification should:

• Be in clear, plain English — not legal boilerplate.
• Describe the nature of the breach.
• Give the name and contact details of your DPO or point of contact.
• Describe the likely consequences.
• Describe the measures you've taken and what people should do (e.g. change passwords, monitor accounts, be alert to phishing).

What happens if you're the victim, not the organisation?

If a company has lost your data — or you've received one of those "we've had a security incident" emails — you also have options. You don't report the breach to the ICO on the company's behalf, but you can:

• Raise a complaint with the ICO if you think the organisation hasn't handled things properly. Go to ico.org.uk and use the "Make a complaint" route.
• Change passwords on the affected service and anywhere you reused them.
• Watch for scams — phishing emails, texts, and calls often spike after a breach, because criminals buy and resell leaked data fast.
• Monitor your email and phone number for appearances in future breaches.
• Consider a credit freeze or fraud alert through Experian, Equifax, or TransUnion if financial data was involved.

That monitoring and scam-watching work is where most people quietly drop the ball — and where Lunyb comes in.

How Lunyb helps after a data breach — the practical next step

Reporting a breach is only step one. The harder part is the weeks and months afterwards, when leaked data gets traded between fraud groups and shows up as phishing emails, dodgy texts, scam calls, and credential-stuffing attempts on your other accounts. Lunyb is built to handle that long tail in one app — so you don't need to juggle five separate tools or hope you'll notice something is wrong.

Data Breach Alerts for email and phone

Lunyb's Data Breach Alerts continuously check your email addresses and phone numbers against known breach datasets. If your details appear in a new leak, we tell you which service was breached, what kind of data was exposed, and the concrete steps to take — change this password here, enable 2FA there, revoke these tokens. It turns a vague "your data might be out there" into a clear to-do list.

Scam Checker and Scam Shield

Breach victims get hit hardest by follow-on scams. Our Scam Checker lets you paste any suspicious message, email, or link and get a fast read on whether it's a known scam pattern. Scam Shield helps reduce nuisance and fraud calls on your phone. If a fraudster bought your number in a breach and is now trying to impersonate your bank or HMRC, this is the layer that catches them before you do.

Privacy Check and Security Score

Our Privacy Check reviews the permissions your apps have quietly collected and flags the ones that are over-reaching. Your Security Score gives you a single number that moves up as you fix issues, so you can actually see progress instead of guessing.

Password and Photo Vault

After a breach, you'll be changing a lot of passwords. The encrypted Password Vault stores them properly so you're not reusing old ones — reuse is what turns one breach into five. The Photo Vault keeps sensitive images (ID scans, documents) off your camera roll and out of cloud backups you didn't mean to make.

On-device tracker and threat blocking

Lunyb's on-device network-level shield uses encrypted DNS to block known trackers, malicious domains, and sketchy ad networks before your browser or apps even connect to them. Combined with our browsing-history eraser, it cuts down the data trail that leads to the next breach.

Data-broker exposure help and Photo Guard

We also help you tackle data-broker style exposure, where your name, address, and phone are listed on people-search sites — a common follow-up risk after a breach. Photo Guard runs reverse-image checks so you can see where a photo of you is already appearing online.

Plans start from about £19.99 / $19.99 a month, renew until you cancel, and you can cancel any time from your account — no phone calls, no retention script. Optional Leak Protection is billed separately and can be paused without cancelling your main plan. That's the kind of straightforward pricing we think a privacy app should have. If you want the fuller picture, our team wrote an honest walkthrough here: Is Lunyb Legit? Honest Review of the Privacy-First URL Shortener (2026).

Quick comparison: doing it manually vs. using Lunyb

Common mistakes organisations make when reporting breaches

From public ICO enforcement notices and guidance, the same mistakes keep coming up. Avoid these:

• Waiting until the investigation is complete. You don't need a full picture to report — report what you know within 72 hours and update later.
• Underestimating the risk. "It was only email addresses" can still enable targeted phishing. Assess impact properly.
• Not telling individuals when you should. If high risk exists, direct notification isn't optional.
• No breach log. The ICO expects to see all breaches recorded, including the ones you decided not to report, with reasoning.
• Blaming the staff member. Human error is a systems issue. Focus on training, access controls, and process fixes.
• No follow-up. The regulator wants to see root-cause analysis and a credible fix, not just an apology.

Protecting yourself before the next breach

You can't stop every organisation that holds your data from being hacked. What you can control is how exposed you are and how fast you react. A sensible personal baseline looks like this:

1. Use a unique, strong password for every account — stored in a proper vault, not reused.
2. Turn on two-factor authentication on email, banking, and anything that stores payment details.
3. Monitor your email and phone number for appearances in new breaches.
4. Treat unsolicited messages with suspicion, especially ones that create urgency.
5. Reduce your exposure on people-search and data-broker sites.
6. Review app permissions on your phone at least twice a year.

Lunyb bundles the monitoring, the scam checking, the vault, and the on-device protection into one place so you're not stitching it together yourself. Start with our free privacy quiz on lunyb.com — it takes a couple of minutes and tells you where you're most exposed.

Frequently asked questions

How long do I have to report a data breach to the ICO?

You have 72 hours from the moment your organisation becomes aware of the breach. If you can't gather all the facts in time, submit a partial report within 72 hours and provide the remaining information in phases. Late reporting without a justified reason is itself a UK GDPR infringement.

What's the fastest way to report a breach to the ICO?

Use the ICO's online self-reporting tool at ico.org.uk. For urgent cases or where you need guidance, call the ICO breach helpline on 0303 123 1113 during business hours. Keep a copy of everything you submit.

Do I need to report every single data breach?

No. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. Low-risk breaches don't need to be reported but must still be recorded in your internal breach log along with your reasoning.

What should I do if my data was leaked in a company's breach?

Change the password on the affected service and anywhere you reused it, enable two-factor authentication, watch for phishing attempts, and consider monitoring your email and phone for future appearances in breach data. Lunyb's Data Breach Alerts and Scam Checker are built for exactly this moment.

Can I be fined personally if my employer suffers a data breach?

Fines under UK GDPR are issued to the organisation, not usually to individual employees, unless there's deliberate or reckless personal conduct. However, criminal offences do exist under the Data Protection Act 2018 for things like knowingly obtaining or disclosing personal data without consent. If in doubt, speak to your DPO or seek legal advice.

Your next step

If you're an organisation: contain, assess, report within 72 hours, notify individuals where risk is high, and record everything. If you're an individual whose data was caught up in a breach: change passwords, enable 2FA, and get monitoring in place so you're not the last to know next time.

Lunyb gives you Data Breach Alerts, Scam Checker, Scam Shield, an encrypted Password Vault, Privacy Check, data-broker exposure help, and on-device tracker blocking in one app — with transparent pricing from about £19.99 / $19.99 a month and cancel-anytime online. Take the free privacy quiz on lunyb.com or download the Lunyb app from the App Store or Google Play to get started today.