How to Report a Data Breach to the ICO: A Complete UK Guide

If you suspect personal data has been exposed, leaked, or stolen, the clock is already ticking. Under UK GDPR, certain breaches must be reported to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of them. Miss that window, and you risk regulatory action on top of the breach itself.

This guide walks you through exactly how to report a data breach to the ICO, what information you need, and what to do before, during, and after the report. We'll also show how Lunyb gives individuals and small teams an always-on early warning system so a breach never catches you cold.

What Counts as a Data Breach Under UK GDPR

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is broader than just a hack.

Common examples the ICO treats as breaches

• An email with personal data sent to the wrong recipient.
• A lost or stolen laptop, phone, or USB stick containing customer records.
• Ransomware encrypting files that include personal data.
• A misconfigured database left exposed on the internet.
• An employee accessing records they had no business reason to view.
• Phishing that resulted in credentials being handed to an attacker.

Breaches fall into three categories: confidentiality (unauthorised access), integrity (unauthorised alteration), and availability (loss of access, including ransomware). An incident can fit more than one.

When You Must Report a Data Breach to the ICO

Not every incident is reportable. Under UK GDPR Article 33, you must notify the ICO when the breach is likely to result in a risk to the rights and freedoms of individuals. If the risk is high, you must also inform the affected individuals directly.

The 72-hour rule

You have 72 hours from the moment you become aware of the breach to notify the ICO. "Aware" means you have a reasonable degree of certainty that a security incident has occurred and led to personal data being compromised — not the moment someone first raises a suspicion.

When you do not need to report

• The breach is unlikely to result in any risk to individuals (for example, data that was already public, or lost data that was strongly encrypted and the key is safe).
• You are a data processor — in that case you must notify the controller without undue delay, and they decide on ICO notification.

When in doubt, document your reasoning. The ICO expects you to be able to justify a decision not to report.

How to Report a Data Breach to the ICO: Step by Step

Follow this process to stay compliant and calm under pressure.

1. Contain the breach. Revoke compromised credentials, isolate affected systems, recall misdirected emails if possible, and stop the bleed before anything else.
2. Assess the scope. Identify what data was involved, how many people are affected, what categories (names, financial, health, children's data), and the likely consequences.
3. Decide if it is reportable. Apply the "risk to rights and freedoms" test. Err on the side of reporting if you are genuinely unsure.
4. Gather the facts. You will need a timeline, a description of the breach, the categories and approximate number of individuals and records affected, likely consequences, and the measures you have taken or propose to take.
5. Report via the ICO's channels. Use the ICO's online "report a breach" service at ico.org.uk, or call their breach helpline on 0303 123 1113 during working hours. Out of hours, the online form is the fastest route.
6. Notify affected individuals if required. If the risk is high, tell them without undue delay in clear, plain language: what happened, likely consequences, what you are doing, and what they can do to protect themselves.
7. Document everything. Even breaches you do not report must be recorded internally. The ICO can ask to see your breach log.
8. Review and improve. Run a post-incident review. Update policies, training, and technical controls so the same gap does not open twice.

What Information the ICO Will Ask For

The ICO's online form is structured so you can submit what you know now and update later. Have these ready:

• Your organisation's name and ICO registration number (if applicable).
• Contact details for the Data Protection Officer or breach contact.
• Date and time the breach happened and when you became aware.
• Nature of the breach (confidentiality, integrity, availability).
• Categories and approximate number of data subjects and records.
• Types of personal data involved (contact details, financial, special category).
• Likely consequences and risk level.
• Measures taken to contain and mitigate.
• Whether individuals have been or will be informed.

If you miss the 72-hour deadline

Report anyway, and explain the delay. A late report with a credible explanation is far better than no report. The ICO is more concerned with honesty, cooperation, and improvement than with perfection under pressure.

Reporting as an Individual vs a Business

The 72-hour ICO reporting duty applies to organisations acting as data controllers. If you are an individual whose data has been breached by someone else, your route is different — but no less important.

How Lunyb Helps You Spot and Respond to Breaches Faster

The single biggest predictor of damage from a data breach is how quickly you find out about it. Most people learn their data was exposed months or years after the fact — long after criminals have already used it. Lunyb closes that gap.

Data Breach Alerts for your email and phone number

Lunyb's Data Breach Alerts continuously monitor whether your email addresses and phone numbers appear in known data exposures. When something turns up, you get an alert with context on what was leaked (passwords, addresses, payment details), so you know exactly which accounts to secure first. For a business owner, that same monitoring across your personal and work accounts can be the earliest signal that credentials have been compromised — often before the breach is public.

Scam Checker and Scam Shield

Post-breach, you become a target. Attackers combine leaked data with phishing messages that reference real information to trick you into handing over more. Lunyb's Scam Checker lets you paste any suspicious message or link and get a verdict, while Scam Shield helps filter the flood of dodgy calls that often follows a breach.

Privacy Check and Security Score

Prevention beats reporting. Lunyb's Privacy Check reviews app permissions on your phone, and the overall Security Score highlights the gaps attackers love — stale apps with excessive access, unprotected accounts, exposed numbers.

Password and Photo Vault

A huge share of breaches start with reused passwords. Lunyb's encrypted Password Vault keeps unique credentials behind strong encryption, while the Photo Vault locks away sensitive images (ID scans, documents) that would otherwise sit in your camera roll waiting for the next device compromise.

On-device tracker and threat blocking

Lunyb's on-device, network-level protection blocks known trackers and malicious domains before your phone even talks to them. That reduces the attack surface that leads to credential theft in the first place — no browser extension to remember, no complex setup.

Leak Protection as an add-on

For people who want a dedicated layer against data broker exposure, Lunyb offers optional Leak Protection billed separately. You can pause it without cancelling your main plan, which is handy if your needs change.

Plans start from about £19.99-equivalent per month and renew until cancelled, with cancellation available online at any time. There is no long contract to argue your way out of — you stay because Lunyb earns it.

Practical Checklist: The First 72 Hours After a Breach

1. Hour 0–1: Contain. Change passwords, revoke tokens, isolate affected systems.
2. Hour 1–6: Convene your response team. Open an incident log and start timestamping decisions.
3. Hour 6–24: Assess scope. Identify data categories, affected individuals, likely consequences.
4. Hour 24–48: Draft ICO notification. Prepare individual communications if risk is high.
5. Hour 48–72: Submit to the ICO. Send plain-language notifications to affected people.
6. Day 3 onwards: Post-incident review, update controls, add continuous monitoring so the next exposure gets flagged early.

Common Mistakes to Avoid

• Waiting for certainty. You do not need every fact before notifying the ICO — a phased report is accepted and expected.
• Quiet containment. Deciding not to report because you "handled it" without documenting the reasoning is a regulatory red flag.
• Vague individual notices. Telling people there was "an issue with our systems" without saying what to do next damages trust and invites complaints.
• Blaming the processor. Controllers remain accountable. Make sure your contracts and processor relationships are clear before an incident forces the issue.
• No monitoring afterwards. Breached credentials get recycled for years. Ongoing alerts (like Lunyb's) are essential.

Take the Next Step With Lunyb

Reporting a breach well is important. Not needing to report one — because you spotted the weakness first, or because an alert reached you before damage spread — is better. Lunyb gives you both: fast detection through Data Breach Alerts, defence through Scam Shield and on-device blocking, and recovery tools like the Password Vault to lock everything down after the fact.

Start at lunyb.com with the free privacy quiz to see where your personal exposure sits right now, or download the Lunyb app from the App Store or Google Play and turn on monitoring in minutes. If you also handle links for your business, try the Lunyb link shortener and secure QR tool — and see our take on alternatives in our Rebrandly review and honest Lunyb review.

Frequently Asked Questions

How long do I have to report a data breach to the ICO?

You have 72 hours from the moment you become aware of a notifiable breach. If you miss the deadline, still report and explain the delay — the ICO values honesty and cooperation over silence.

Do I have to report every data breach?

No. You only need to report breaches that are likely to pose a risk to the rights and freedoms of individuals. However, you must record every breach internally, including the reasoning for not reporting, in case the ICO asks to see your log.

Can an individual report a company to the ICO for a data breach?

Yes. If a company has mishandled your personal data and you are not satisfied with their response, you can raise a complaint with the ICO at ico.org.uk. Contact the company first, give them a reasonable chance to respond, then escalate.

What happens if I do not report a breach?

Failing to notify the ICO when required can result in enforcement action and fines of up to £8.7 million or 2% of global annual turnover, whichever is higher. More serious breaches of UK GDPR can attract higher fines. Reputational damage from undisclosed breaches that later come to light is often worse than the fine itself.

How does Lunyb help me find out about breaches involving my data?

Lunyb's Data Breach Alerts continuously monitor your email addresses and phone numbers against known exposures and notify you when something turns up, with details on what was leaked so you can act. Combined with the Password Vault, Scam Checker, and Privacy Check, it gives individuals a response kit that normally requires several separate tools.