How to Report a Data Breach to the ICO: A Complete UK Guide

If your organisation has suffered a personal data breach, the clock is already ticking. Under the UK GDPR and the Data Protection Act 2018, you may have as little as 72 hours to notify the Information Commissioner's Office (ICO). Miss the deadline or get the details wrong, and you risk enforcement action on top of the breach itself.

This guide from the Lunyb editors walks you through exactly how to report a data breach to the ICO, what information to prepare, and how to keep your people and customers safe during the response. We'll also show you how Lunyb gives individuals and small teams an always-on early warning system so breaches don't catch you by surprise in the first place.

What counts as a data breach under UK GDPR

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It isn't only hackers — a lost laptop, a misaddressed email, or a filing cabinet left unlocked can all qualify.

The ICO groups breaches into three categories:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
• Integrity breach — unauthorised or accidental alteration of personal data.
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data.

Any of these can trigger a reporting obligation if they're likely to result in a risk to people's rights and freedoms.

Do you actually need to report the breach to the ICO?

Not every incident must be reported. The test is whether the breach is likely to result in a risk to the rights and freedoms of individuals. If yes, you must report. If the risk is high, you must also tell the affected people.

Report to the ICO when:

• Personal data has been exposed, lost, altered or stolen.
• Individuals could suffer financial loss, identity theft, reputational damage, discrimination, or loss of confidentiality.
• Sensitive data (health, finance, children's data, special category data) is involved.

You may not need to report when:

• The data was strongly encrypted and the key is safe.
• No personal data was actually accessed or affected.
• The risk to individuals is genuinely negligible.

Even if you decide not to report, you must document the incident, your reasoning, and the steps you took. The ICO can ask to see your breach log at any time.

The 72-hour rule: how the deadline actually works

Article 33 of the UK GDPR requires controllers to notify the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware of a notifiable breach.

"Becoming aware" doesn't mean the moment someone reports a suspicion. It means the point at which you have a reasonable degree of certainty that a security incident has occurred and personal data has been compromised. A brief investigation to confirm this is acceptable — and expected.

If you miss the 72-hour window, you can still report, but you must include reasons for the delay. Late reporting isn't a hidden shortcut; the ICO takes it seriously.

How to report a data breach to the ICO: step by step

Here is the process the ICO expects UK controllers to follow.

1. Contain the breach. Stop the data loss. Revoke access, change credentials, isolate affected systems, or recall the misdirected email.
2. Assess the risk. What data was involved? How many people? What harm could result?
3. Record the incident internally. Start your breach log straight away — dates, times, decisions, people involved.
4. Decide whether to notify the ICO. Use the risk test above. If unsure, err on the side of reporting.
5. Submit your report. Use the ICO's online self-assessment and reporting tool at ico.org.uk, or call their helpline on 0303 123 1113 during office hours.
6. Notify affected individuals if the risk is high. Use clear, plain English. Tell them what happened, what data is involved, and what they can do.
7. Review and improve. After the dust settles, run a post-incident review and update your policies, training, and technical controls.

What information you need before you report

The ICO's online reporting form asks for structured detail. Prepare the following before you start:

• Your organisation's name, sector, and ICO registration number.
• Contact details for your Data Protection Officer or breach lead.
• Date and time the breach happened and when you became aware of it.
• A description of the breach — what happened, how, and why.
• Categories and approximate number of individuals affected.
• Categories and approximate number of personal data records affected.
• The likely consequences for individuals.
• The measures you have taken or propose to take to address the breach and mitigate harm.
• Whether you have informed the affected individuals, and if not, why.

You can submit a partial report and provide further information in phases if a full investigation is still underway — just say so on the form.

When and how to tell the people affected

If the breach is likely to result in a high risk to the rights and freedoms of individuals, you must inform them directly and without undue delay. That usually means email, letter, or in-app message — not a buried website notice.

Your notification should include:

• A clear, plain-English description of what happened.
• The name and contact details of your DPO or privacy lead.
• The likely consequences of the breach.
• The measures taken or proposed to deal with it.
• Practical advice to help individuals protect themselves (change passwords, watch for phishing, check statements).

You don't need to notify individuals if the data was strongly encrypted, if you've already taken measures that eliminate the high risk, or if direct contact would involve disproportionate effort — in which case a public communication is acceptable.

Penalties for getting it wrong

The ICO has a graduated set of enforcement powers. For failing to report a notifiable breach, fines can reach up to £8.7 million or 2% of global annual turnover, whichever is higher. For more serious infringements of UK GDPR, the ceiling rises to £17.5 million or 4% of global turnover.

In practice, the ICO is more interested in whether you took data protection seriously than in punishing a single mistake. Organisations that have documented policies, run training, respond quickly, and co-operate honestly usually fare far better than those that try to minimise or hide what happened.

How Lunyb helps you detect and respond to breaches faster

Reporting a breach is only half the job. The other half — often the harder half — is knowing when personal data tied to your staff, customers, or your own accounts has been exposed in the first place. That's where Lunyb becomes the practical next step after reading this guide.

Lunyb is a privacy and scam-protection platform built for individuals, families, and small teams in the UK. It brings together the tools you'd otherwise need half a dozen separate services for.

Early warning with Data Breach Alerts

Lunyb's Data Breach Alerts monitor your email addresses and phone numbers against known breach datasets. If your credentials appear in a new leak, you get notified so you can rotate passwords, revoke tokens, and start your incident response before an attacker uses the data. For a DPO or small-business owner, this cuts the gap between a breach happening and you "becoming aware" — which is exactly what the 72-hour clock turns on.

Scam Checker and Scam Shield

Most breaches start with a phishing text, a dodgy link, or a spoofed call. Lunyb's Scam Checker lets you paste a suspicious message or URL and get a quick verdict, while Scam Shield helps block unwanted and risky callers. Fewer successful phishing attempts means fewer breaches to report.

Privacy Check and Security Score

Our Privacy Check reviews the permissions your apps have quietly collected, and your Security Score gives you a running view of where your personal footprint is weakest. Combined with the data-broker exposure tools, it's a practical way to shrink the amount of personal data floating around in the first place.

Encrypted Vault and on-device protections

Lunyb includes an encrypted Password and Photo Vault, Photo Guard reverse-image checks, a browsing-history eraser, and an on-device DNS shield that blocks trackers and known malicious domains at the network level — all without needing the acronym some people reach for first. If you share devices with family, the family location sharing keeps everyone accounted for without handing data to third-party advertisers.

Clear UK-friendly pricing

Plans start from about £19.99/month equivalent and renew until you cancel — and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. No hidden tiers, no awkward phone-only cancellations.

Lunyb vs doing it all manually

A practical breach-response checklist

1. Contain the incident and preserve evidence.
2. Open your breach log and record the facts as you learn them.
3. Run the risk assessment against UK GDPR Article 33 and 34 criteria.
4. Notify the ICO within 72 hours if required — partial report is fine.
5. Inform affected individuals if the risk is high, with clear next steps.
6. Rotate credentials, revoke tokens, and tighten access.
7. Use Lunyb's Data Breach Alerts to monitor affected addresses for follow-on leaks.
8. Run a post-incident review and update training, policies, and technical controls.

Frequently asked questions

How long do I have to report a data breach to the ICO?

You must report a notifiable breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Late reports are accepted but must include the reasons for the delay.

What happens if I report a breach that turns out not to be notifiable?

Nothing punitive. The ICO would rather you over-report than under-report. If your investigation shows the risk was lower than feared, you can update or withdraw the report and keep the record in your internal breach log.

Do I have to tell affected individuals every time?

No. You only need to notify individuals directly when the breach is likely to result in a high risk to their rights and freedoms. Lower-risk breaches may still need ICO notification but not individual notification.

How can Lunyb help me spot a breach sooner?

Lunyb's Data Breach Alerts monitor your email addresses and phone numbers against known breach datasets and notify you when they appear in new leaks. That shortens the gap between the incident happening and you becoming aware — which is exactly when your 72-hour clock starts. Start free at lunyb.com.

Is Lunyb suitable for small UK businesses as well as individuals?

Yes. Individuals, families, and small teams use Lunyb to monitor exposure, catch phishing, lock down app permissions, and store credentials securely. For larger organisations with a formal DPO, Lunyb complements enterprise tooling by protecting the personal accounts and devices your staff actually use day-to-day. You can read more about our approach in our honest review of Lunyb.

Your next step

Reporting a breach to the ICO is manageable if you know the rules and move quickly. The harder part is avoiding the next one — and being the first to know when your data leaks somewhere else on the web.

Take the free privacy quiz on lunyb.com, or download the Lunyb app from the App Store or Google Play, to switch on Data Breach Alerts, Scam Checker, Privacy Check, and the rest of our toolkit. One subscription, cancel anytime, and a clear view of where your personal data actually stands.

Prefer to see how we compare on the link-sharing side first? Have a look at our Rebrandly vs Lunyb review and our independent Lunyb review.