How to Report a Data Breach to the ICO: A Complete UK Guide

If you've experienced a data breach in the UK — whether you're a business handling customer data or an individual whose information has been exposed — reporting it to the Information Commissioner's Office (ICO) is often a legal requirement, not an optional step. The UK GDPR gives organisations just 72 hours from becoming aware of a notifiable breach to report it, and individuals affected by serious breaches have the right to know what happened to their data.

This guide walks you through exactly how to report a data breach to the ICO, what counts as reportable, and what you should do next. We'll also show you how Lunyb helps you monitor your own email and phone number for breaches so you can act fast — ideally before the damage spreads.

What Counts as a Data Breach Under UK GDPR

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. The ICO — the UK's independent data protection regulator — treats this broadly: it's not just hackers stealing a database.

Common examples the ICO considers reportable include:

• A laptop, phone, or USB stick containing personal data lost or stolen
• An email with personal data sent to the wrong recipient
• A ransomware or phishing attack that exposes customer records
• Paper files left on a train or in a public place
• A misconfigured database left accessible on the internet
• An employee accessing records they weren't authorised to view

Not every incident must be reported. The threshold is whether the breach is likely to result in a risk to the rights and freedoms of individuals. If the risk is low — for example, properly encrypted data was lost and the decryption key is safe — you may not need to notify the ICO, but you must still document it internally.

Who Has to Report

Under UK GDPR, the data controller is responsible for reporting. If you're a data processor (processing data on behalf of someone else), you must notify the controller without undue delay, and they take it from there.

Individuals who are victims of a breach don't report to the ICO in the same way — but you can and should raise a concern or complaint with the ICO if an organisation has mishandled your data, especially if they haven't told you about a breach you believe has occurred.

The 72-Hour Deadline: What You Need to Know

The UK GDPR sets a strict timeline: organisations must report a notifiable personal data breach to the ICO within 72 hours of becoming aware of it. That clock includes weekends and bank holidays.

If you can't provide all the information within 72 hours, you can still make an initial report and provide further details in phases. The ICO explicitly allows this — it's better to notify on time with partial information than to miss the deadline while you gather everything.

If you report later than 72 hours, you must explain the reasons for the delay. Unjustified late reporting can itself be a breach of UK GDPR and may increase any penalty.

How to Report a Data Breach to the ICO: Step by Step

Here is the practical process for organisations reporting a breach to the ICO.

1. Contain the breach. Before anything else, stop the data leak if it's ongoing. Revoke access, isolate affected systems, recover lost devices, or request recall of misdirected emails.
2. Assess the risk. Decide whether the breach is likely to result in a risk to individuals. Consider the type of data, how sensitive it is, how many people are affected, and the likelihood of harm (identity theft, financial loss, reputational damage, discrimination).
3. Record the breach internally. Even if you decide it's not reportable, UK GDPR requires you to document every personal data breach, the facts, effects, and action taken.
4. Report to the ICO within 72 hours. Use the ICO's online self-assessment and reporting tool on ico.org.uk, or call the ICO's dedicated breach helpline on 0303 123 1113. For out-of-hours reporting, use the online form.
5. Inform affected individuals if the risk is high. If the breach is likely to result in a high risk to individuals, you must tell them directly, without undue delay, in clear plain language.
6. Follow up with the ICO. Provide any further information you couldn't supply in the initial report, and cooperate with any ICO enquiries.
7. Review and learn. Update your policies, retrain staff, patch systems, and strengthen controls so the same breach doesn't happen again.

What Information the ICO Asks For

When you report, be ready to provide:

• A description of the nature of the breach, including categories and approximate number of individuals and records affected
• The name and contact details of your Data Protection Officer or main contact
• The likely consequences of the breach
• The measures you've taken or propose to take to address the breach and mitigate its effects

What If You're an Individual Affected by a Breach

If an organisation has told you your data was involved in a breach — or you suspect it was — you have rights. You can:

• Ask the organisation exactly what data of yours was affected and what they're doing about it
• Raise a concern with the ICO at ico.org.uk if you think the organisation hasn't handled it properly
• Monitor your accounts, change passwords, and watch for phishing attempts targeting you
• Consider claiming compensation if you've suffered financial loss or distress

The ICO won't usually get you compensation directly — that's a matter for the courts or the organisation — but they can investigate and fine organisations that break the law.

Stay Ahead of Breaches with Lunyb

The hardest part of a data breach, as an individual, is that you're often the last to know. Companies sometimes take months to disclose, and by the time a breach notification letter lands, your email address and password may already be circulating on dark-web forums. That's where Lunyb changes the picture.

Lunyb is a privacy and scam-protection app built for people who want to get out in front of breaches instead of reacting to them. Here's how it helps in the UK context:

• Data Breach Alerts for your email and phone number. Lunyb continuously checks whether your email address or UK mobile number appears in known data breaches. When a new breach surfaces, you get notified so you can change passwords, enable two-factor authentication, and brace for phishing — fast.
• Scam Checker for suspicious messages and links. After a breach, criminals often follow up with convincing phishing texts and emails pretending to be your bank, HMRC, Royal Mail, or the company that was breached. Paste anything suspicious into Lunyb's Scam Checker and get a quick read before you click.
• Scam Shield caller protection. Breached phone numbers get hammered with scam calls. Lunyb helps screen them so you're not fielding fake fraud-department calls all day.
• Privacy Check. Review which apps on your phone have access to your contacts, location, microphone, and camera — and cut off the ones that shouldn't. Fewer permissions mean less data exposed if any one app is breached.
• Encrypted Password & Photo Vault. Store unique passwords and sensitive documents (passport scans, utility bills used for ID) in an encrypted vault so a single breach doesn't cascade across every account you own.
• Data-broker exposure help. Lunyb helps you reduce how much of your personal information is floating around on public people-search and data-broker sites — the same sites criminals comb through to build targeted scams after a breach.
• On-device tracker and threat blocking. A local DNS shield blocks known tracking and malicious domains on your phone, cutting the amount of data leaking out of apps in the background.
• Security score. A single number that reflects how exposed you are, with clear actions to raise it week by week.

Doing all of this by hand means juggling a dozen websites, remembering to check breach databases regularly, learning how data brokers work, and reading scam alerts on your own time. Lunyb pulls it into one app and one dashboard, so you actually keep up with it.

Plans start from about £19.99/month equivalent (billed in your local currency) and renew until cancelled. You can cancel anytime online — no phone calls, no retention gauntlet. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. Start with the free privacy quiz on lunyb.com to see where you stand.

Reporting vs Monitoring: Where Each Tool Fits

The ICO and tools like Lunyb play different roles. Here's a simple comparison.

The ICO is who you turn to when something has gone wrong at an organisation. Lunyb is who you turn to so that when something goes wrong somewhere else, you're ready for the fallout on your personal accounts.

Common Mistakes When Reporting a Breach

If you're the one making the report on behalf of a company, avoid these pitfalls:

• Waiting for certainty before reporting. You don't need the full forensic picture — you need a credible initial report within 72 hours.
• Failing to document low-risk breaches. Even if you decide not to notify the ICO, you must keep an internal record.
• Forgetting the individuals. High-risk breaches require direct notification to affected people in plain English.
• Vague language with the ICO. Be specific about categories of data, numbers affected, and mitigation steps.
• No follow-up. If your initial report was partial, send updates. Silence looks like non-cooperation.

After the Report: What Happens Next

The ICO will review your report and may:

• Take no further action if you've handled the breach appropriately
• Ask for more information
• Open an investigation
• Issue advice, warnings, reprimands, enforcement notices, or — in serious cases — fines

Fines under UK GDPR can reach up to £17.5 million or 4% of annual global turnover, whichever is higher. In practice, the ICO reserves the largest penalties for severe, systemic failures. Cooperative, well-documented, quickly-reported breaches are treated far more leniently than hidden or delayed ones.

Protect Yourself Before the Next Breach Headline

Data breaches aren't rare events any more. From loyalty schemes to NHS contractors to global retailers, UK consumers see new incidents every few weeks. You can't stop organisations from being breached — but you can make sure you hear about it first, that your passwords aren't reused across accounts, and that the inevitable scam calls and phishing texts bounce off you.

That's exactly what Lunyb is built for. Take the free privacy quiz on lunyb.com, see your exposure score, and download the Lunyb app from the App Store or Google Play to switch on Data Breach Alerts, Scam Checker, and Scam Shield. If you also need secure short links and QR codes for your business, Lunyb's link platform is in the same account — see our honest review of Lunyb's URL shortener or compare it to alternatives in our Rebrandly review.

Frequently Asked Questions

How quickly must I report a data breach to the ICO?

Within 72 hours of becoming aware of the breach, if it's likely to result in a risk to individuals' rights and freedoms. The clock includes weekends. If you can't gather all details in time, submit an initial report and follow up with more information afterwards.

What's the phone number for the ICO breach helpline?

The ICO's personal data breach helpline is 0303 123 1113, option 3, available during office hours. Outside of hours, use the online reporting form at ico.org.uk.

Do I have to tell affected customers about the breach?

Only if the breach is likely to result in a high risk to their rights and freedoms. In that case, you must contact them directly, without undue delay, using clear and plain language explaining what happened and what they can do.

What if I'm an individual whose data was leaked — can I report to the ICO?

You can raise a concern or complaint with the ICO about how an organisation handled your personal data. The ICO investigates organisations rather than acting as your personal advocate, but complaints are an important signal that drives action. Meanwhile, use a tool like Lunyb's Data Breach Alerts so you find out about future breaches affecting you as soon as they surface.

Can Lunyb stop my data from being breached in the first place?

No tool can guarantee that — breaches happen at companies that hold your data, not on your phone. What Lunyb does is reduce your exposure (fewer app permissions, less data on broker sites, stronger unique passwords in an encrypted vault) and catch breaches that affect your email or phone quickly so you can respond before criminals do.