How to Report a Data Breach to the ICO: A Complete UK Guide

If your personal data has been exposed — or you run an organisation that has suffered a security incident — knowing how to report a data breach to the ICO quickly can be the difference between a controlled response and a costly one. In the UK, the Information Commissioner's Office (ICO) is the regulator responsible for data protection under UK GDPR and the Data Protection Act 2018. Reporting on time matters: organisations generally have 72 hours from awareness of a notifiable breach.

This guide walks you through exactly how to report, when you must report, and what to do before and after. And because most breaches only come to light after your email, phone or passwords have already leaked somewhere, we'll also show you how Lunyb's breach alerts and privacy tools help you catch exposures early — so you can act before a small leak becomes a notifiable incident.

What counts as a data breach under UK GDPR?

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is not only hacking — a lost laptop, a misdirected email, or a misconfigured database all qualify.

Three types of breach the ICO recognises

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
• Integrity breach — unauthorised or accidental alteration of personal data.
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (for example, ransomware).

Does every breach need to be reported?

No. You only need to report a breach to the ICO if it is likely to result in a risk to the rights and freedoms of individuals. If the risk is unlikely — for example, strongly encrypted data was lost but the keys are safe — you may not need to notify the ICO, but you must still document the incident internally.

The 72-hour rule: when you must report a data breach to the ICO

Under Article 33 of UK GDPR, a data controller must notify the ICO of a notifiable breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it. If you miss the deadline, you must explain the reasons for the delay in your report.

When the clock starts

Awareness begins the moment you have a reasonable degree of certainty that a security incident has occurred that led to personal data being compromised — not when the investigation is complete. A short initial investigation to confirm a breach is acceptable, but you should not delay reporting while you gather every detail.

What if you don't have all the facts yet?

The ICO accepts phased reporting. You can submit an initial report within 72 hours and provide further information as your investigation progresses. It is better to notify with partial information than to miss the deadline.

How to report a data breach to the ICO: step by step

The ICO offers a dedicated reporting process for organisations. Here is the straightforward workflow.

1. Contain the breach. Stop the data flow — revoke access, isolate affected systems, recall misdirected emails, change compromised credentials.
2. Assess the risk. Consider what data is involved, how many people are affected, and the potential harm (identity theft, financial loss, distress, discrimination).
3. Decide whether it's notifiable. If there's a likely risk to individuals' rights and freedoms, it must be reported.
4. Report to the ICO. Use the Personal Data Breach reporting form on ico.org.uk, or call the ICO helpline on 0303 123 1113 during business hours for urgent cases.
5. Notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms. This must be done without undue delay, in plain language.
6. Document everything — facts, effects, remedial action — in your internal breach register, even for breaches you did not report.

What information the ICO asks for

• Nature of the breach, including categories and approximate number of individuals and records affected.
• Name and contact details of your Data Protection Officer or main contact.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach and mitigate its effects.

What to do if you're the individual whose data was breached

If you've received a notification from a company saying your data has been exposed — or you suspect it — you have rights and practical steps to take. You can also report concerns about an organisation's handling of your data to the ICO directly.

Immediate actions

1. Change the password on the affected account and any account where you reused it.
2. Enable two-factor authentication wherever possible.
3. Watch for phishing — attackers often follow up breach notifications with fake "reset your account" emails.
4. Check your bank and card statements if financial data was involved.
5. Consider a credit reference check through Experian, Equifax or TransUnion if ID data was leaked.
6. Report concerns to the ICO at ico.org.uk/make-a-complaint if the organisation is not taking it seriously.

Report scams linked to the breach

Many breaches lead to scam calls, SMS and phishing emails. In the UK, forward suspicious texts to 7726, suspicious emails to report@phishing.gov.uk, and report fraud to Action Fraud on 0300 123 2040.

How Lunyb helps you stay ahead of data breaches

The hardest part of a breach is often not the reporting — it's finding out you were affected in the first place. Companies can take weeks or months to disclose incidents, and many leaks appear on hacker forums long before an official notification lands in your inbox. That's where Lunyb comes in.

Lunyb is a privacy and scam-protection app built to catch exposures early and make it easy to respond. For UK readers worried about data breaches — whether as an individual or as a small-business owner protecting your contacts — here are the Lunyb tools that matter most for this topic:

Data Breach Alerts for your email and phone

Lunyb continuously monitors known breach sources and alerts you when your email address or phone number appears in a new exposure. Instead of hoping a company notifies you within 72 hours, you learn as soon as the data surfaces — so you can change passwords, rotate accounts and brace for phishing before criminals start using the data.

Scam Checker and Scam Shield

After a breach, the follow-on attacks are the real damage: convincing phishing texts, fake bank calls, bogus delivery messages. Lunyb's Scam Checker lets you paste a suspicious message or link and get a verdict, while Scam Shield helps block unwanted callers. Together they catch the scams that breaches enable.

Encrypted Password & Photo Vault

Password reuse turns a single breach into a dozen account takeovers. Lunyb's encrypted vault lets you generate and store unique passwords, and keep sensitive photos (ID scans, documents) in a protected space rather than your camera roll.

Privacy Check and Security Score

Lunyb's Privacy Check reviews which apps have access to your contacts, location, microphone and camera. The Security Score gives you one clear number that goes up as you fix weaknesses — a practical way to reduce the amount of personal data floating around before a breach ever happens.

On-device tracker and threat blocking

Lunyb uses an encrypted on-device DNS shield to block trackers, malicious domains and known phishing infrastructure at the network level — without slowing your phone down and without routing your traffic through a third-party tunnel.

Photo Guard and browsing-history eraser

Lunyb's reverse-image check helps you see where your photos appear online, and the browsing-history eraser clears local traces across supported browsers in one tap. Small things, but they shrink your personal data footprint.

Lunyb vs doing it all manually

You can do a lot of this by hand. The question is whether you will — and whether you'll do it fast enough to beat the 72-hour window attackers often use after a breach.

Task	Manual approach	With Lunyb
Know when your email/phone leaks	Check breach-lookup sites one by one	Automatic alerts as new leaks surface
Check a suspicious link or SMS	Guess, Google, or hope	Paste into Scam Checker
Block scam callers	Add each number manually	Scam Shield handles known patterns
Password hygiene	Reuse or try to remember	Encrypted vault with unique passwords
App permission audit	Dig through phone settings per app	Privacy Check in one view
Track trackers on your phone	Not realistic for most people	On-device DNS shield blocks them

Lunyb plans start from about £19.99/month equivalent (listed at $19.99/month), renew until you cancel, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan. That's transparent pricing for a serious set of tools.

Common mistakes when reporting a breach to the ICO

These are the errors the ICO sees most often — avoid them and your report will go much more smoothly.

• Waiting to investigate fully before reporting. Submit an initial report within 72 hours and update it later.
• Downplaying the risk. Even a small amount of sensitive data (health, finance, children's data) can mean high risk.
• Forgetting internal documentation. You must log every breach, even the ones you don't report.
• Not informing affected individuals when the risk is high. Silence often causes more reputational harm than the breach itself.
• Treating it as purely an IT issue. Breach response is legal, operational and communications — all three.

What the ICO can do after you report

The ICO's role is primarily regulatory and advisory. After you report, they may acknowledge the report, request further information, provide guidance, or in serious cases open a formal investigation. Enforcement powers include reprimands, enforcement notices, and monetary penalties under UK GDPR for serious failings. Prompt, honest reporting and good documentation are the strongest signals that your organisation takes data protection seriously.

Protect yourself before the next breach — start with Lunyb

You can't stop every company you've trusted from losing your data. What you can do is make sure you find out quickly, respond before criminals use it, and shrink the amount of personal information exposed about you in the first place. That's exactly what Lunyb is built for.

Take the free privacy quiz at lunyb.com, then download the Lunyb app from the App Store or Google Play to turn on breach alerts, Scam Checker, and Privacy Check. If you've been in a breach already, you'll want these tools working for you today — not after the next incident.

Want to see how we think about privacy and trust in our own products? Read our honest review of Lunyb for the full picture.

Frequently asked questions

How long do I have to report a data breach to the ICO?

Organisations have 72 hours from becoming aware of a notifiable personal data breach to report it to the ICO. If you miss the deadline, you can still report, but you must explain the reason for the delay.

Do I have to report every single breach?

No. You only need to notify the ICO if the breach is likely to result in a risk to individuals' rights and freedoms. However, you must document every breach internally, including the facts, effects and action taken.

How do I report a data breach as an individual in the UK?

If you're a member of the public affected by an organisation's data breach, you can raise a concern or complaint with the ICO via ico.org.uk/make-a-complaint. For related fraud, report to Action Fraud on 0300 123 2040, forward scam texts to 7726, and phishing emails to report@phishing.gov.uk.

Can Lunyb tell me if my data has been in a breach?

Yes. Lunyb's Data Breach Alerts monitor known breach sources for your email address and phone number and notify you when they appear in a new exposure, so you can change passwords and prepare for scam attempts quickly.

What happens if I don't report a breach that I should have?

Failing to report a notifiable breach can itself be a breach of UK GDPR and can attract regulatory action from the ICO, including reprimands, enforcement notices or monetary penalties — on top of any damage from the original incident.