How to Report a Data Breach to the ICO: A Step-by-Step UK Guide

If you've just discovered a data breach, the clock is already ticking. Under UK GDPR, most personal data breaches must be reported to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of them. Miss that window without good reason and you could face enforcement action, fines, and a lot of awkward questions from customers.

At Lunyb, we work with people on both sides of a breach every day — the small business owner who just had their CRM compromised, and the individual whose email keeps turning up on breach lists. This guide walks you through exactly how to report a data breach to the ICO, what to include, and what to do next. We'll also show you how Lunyb's privacy tools help you detect breaches earlier and recover faster, whether you're the controller or the victim.

What Counts as a Data Breach Under UK GDPR

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It's not just hackers — it includes lost laptops, misdirected emails, and files left on a train.

The ICO groups breaches into three types:

Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
Integrity breach — unauthorised or accidental alteration of personal data.
Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (for example, a ransomware attack).

Do You Actually Have to Report It?

Not every breach needs to go to the ICO. You must report a breach if it is likely to result in a risk to the rights and freedoms of individuals. If the risk is high, you must also notify the affected individuals directly.

Examples that almost always need reporting:

Names, addresses, or financial details exposed to unauthorised parties.
Health or special category data leaked.
Login credentials or passwords stolen.
Ransomware encrypting customer records.

Examples where you may not need to report (but must still document internally):

A properly encrypted laptop lost, with no realistic chance of access.
An internal email sent to the wrong colleague who confirms deletion.

Even if you decide not to report, you are legally required to keep an internal record of the breach and your reasoning.

The 72-Hour Rule Explained

The 72-hour window starts when you become aware of the breach — not when it happened, and not when you've finished investigating. "Awareness" means you have a reasonable degree of certainty that a security incident has occurred and personal data is affected.

You don't need all the answers before reporting. The ICO accepts phased reporting: submit what you know, mark the report as incomplete, and send updates as the investigation progresses. Reporting late without a valid reason is itself a compliance failure, so it's almost always better to file early with partial information than to wait.

Step-by-Step: How to Report a Data Breach to the ICO

Reporting a breach to the ICO is done online through their official breach reporting tool. Here's the full process.

Step 1: Contain the Breach

Before you report, stop the bleeding. Disconnect affected systems, revoke compromised credentials, change passwords, and isolate any infected devices. Document every action with timestamps — you'll need this for the report.

Step 2: Assess the Scope and Risk

Identify what personal data is involved (names, emails, financial data, special category data).
Estimate how many individuals are affected.
Determine the likely consequences — identity theft, financial loss, reputational harm, physical risk.
Decide whether the risk to individuals is low, medium, or high.

Step 3: Gather the Information the ICO Needs

You'll be asked for:

The nature of the breach (confidentiality, integrity, availability).
Categories and approximate numbers of data subjects affected.
Categories and approximate numbers of personal data records involved.
Name and contact details of your Data Protection Officer or main contact.
Likely consequences of the breach.
Measures taken or proposed to address the breach and mitigate harm.

Step 4: Submit the Report

Go to the ICO website and use their personal data breach reporting service. You can report online 24/7, or call their breach helpline on 0303 123 1113 during office hours (option 3). If you're a telecoms or internet service provider, you must use the separate security breach report instead.

Step 5: Notify Affected Individuals (If Required)

If the breach is likely to result in a high risk to individuals, you must tell them directly, in plain language, without undue delay. The notification must include:

A description of the breach.
The name and contact details of your DPO or contact point.
Likely consequences.
Measures taken or proposed.
Practical advice on how they can protect themselves.

Step 6: Document Everything

Keep a full internal breach register covering what happened, its effects, and the remedial action taken. The ICO can ask to see this at any time, and a well-maintained log is one of the strongest signals of good governance.

What Happens After You Report

The ICO will acknowledge your report and assign a case reference. Depending on the severity, they may:

Take no further action beyond logging the report.
Request additional information or a follow-up submission.
Open a formal investigation.
Issue enforcement notices, reprimands, or monetary penalties.

Cooperation matters. Organisations that report promptly, communicate honestly, and demonstrate strong remediation are consistently treated more favourably than those that try to minimise or delay.

How to Report a Breach if You're the Victim, Not the Business

If your data was exposed by someone else's breach, you can't file the ICO report — that's the controller's job. But you can:

Raise a concern with the ICO if you believe an organisation has mishandled your data or failed to tell you about a breach. Use the ICO's "Make a complaint" service.
Complain to the organisation first. The ICO usually expects you to give them a chance to respond before escalating.
Report fraud to Action Fraud on 0300 123 2040 if you've lost money or suspect identity theft.
Contact your bank immediately if financial data was involved.
Change passwords on every account that shared the compromised credentials, and switch on two-factor authentication.

Why Lunyb Is the Smart Next Step After a Breach

Whether you run the business that was breached or you're the individual whose data got leaked, the hard part isn't the report — it's everything that comes after. Breached credentials circulate on dark-web forums for years. Phishing emails and scam texts spike in the weeks following a leak. Old accounts you'd forgotten about become attack surfaces.

Lunyb is built exactly for this moment. We combine the tools you'd otherwise have to cobble together from five different services into one app and web platform.

Data Breach Alerts for Email and Phone

Lunyb continuously monitors known breach databases for your email addresses and phone numbers. When your details show up in a new leak, you get alerted — along with practical steps for that specific breach. No more finding out six months later when the fraud has already happened.

Scam Checker and Scam Shield

Breach victims are prime targets for follow-on scams. Fraudsters who bought your data will text and call pretending to be your bank, HMRC, or a delivery company. Lunyb's Scam Checker lets you paste any suspicious message or link to see whether it's dangerous, and Scam Shield helps intercept risky calls before they reach you.

Privacy Check and Security Score

After a breach, you need to audit everything. Lunyb's Privacy Check walks through your app permissions and flags anything over-reaching. Your Security Score gives you a single number to improve, with concrete actions ranked by impact.

Encrypted Password and Photo Vault

Rotating passwords after a breach is pointless if you store them in a notes app. Lunyb's encrypted vault keeps credentials and sensitive photos locked down, so even if your device is compromised the attacker hits a wall.

On-Device Tracker and Threat Blocking

Our local DNS shield blocks known malicious domains and trackers at the network level on your device — so even if you accidentally tap a phishing link from a post-breach scam, the connection often fails before any damage is done.

Photo Guard and Browsing-History Eraser

Reverse-image check your profile pictures to see where they've been reposted, and wipe local browsing history in one tap. Small things, but they close the gaps attackers love.

Plans start from around £19.99/month equivalent, renew until you cancel, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without ending the main plan. It's the transparency we'd want ourselves.

Breach Response: DIY vs Lunyb

Task	Manual approach	With Lunyb
Check if your email is in a breach	Visit multiple breach-check sites manually	Continuous monitoring with alerts
Spot scam texts and links	Guess, or Google each one	Paste into Scam Checker for instant assessment
Block malicious domains	Edit DNS settings yourself	On-device DNS shield, on by default
Audit app permissions	Tap through every app's settings	Privacy Check in one view
Store rotated passwords safely	Notes app or spreadsheet (risky)	Encrypted vault
Reduce data-broker exposure	Opt out from each broker manually	Guided exposure help built in

Common Mistakes When Reporting to the ICO

Waiting to "get all the facts" first. Phased reporting exists for a reason. Submit early, update later.
Underestimating the number of records affected. Use honest estimates and flag uncertainty.
Forgetting to notify individuals. If risk is high, a report to the ICO alone isn't enough.
No internal breach log. Even unreported breaches must be documented.
Vague remediation. "We've improved security" isn't enough — describe specific controls.

How to Prevent the Next Breach

Reporting is reactive. Prevention is where you save money, reputation, and sleep.

Minimise the data you hold. If you don't need it, don't collect it.
Encrypt by default. Devices, backups, and databases.
Enforce strong authentication. Password managers and 2FA across the board.
Monitor continuously. Breach alerts, scam monitoring, and endpoint protection.
Train your team. Phishing simulations beat annual slide decks.
Have an incident response plan. Written, rehearsed, and with the ICO reporting link bookmarked.

Frequently Asked Questions

How long do I have to report a data breach to the ICO?

You have 72 hours from the moment you become aware of a notifiable breach. If you report later, you must explain the reason for the delay. Phased reporting is accepted — you can send partial information first and update as you learn more.

What happens if I don't report a breach?

Failing to report a notifiable breach is itself a UK GDPR infringement. The ICO can issue fines of up to £8.7 million or 2% of global annual turnover (whichever is higher) for failures around breach reporting, on top of any penalty for the underlying security failure.

Can I report a breach that happened to me as an individual?

You can't file the formal breach notification — only the organisation holding your data can. But you can raise a complaint with the ICO if you believe they've mishandled your information or failed to tell you about a breach. Start by complaining to the organisation, then escalate to the ICO if unsatisfied.

Do I need to tell customers about every breach?

No. You only need to notify individuals directly when the breach is likely to result in a high risk to their rights and freedoms. For lower-risk breaches you still report to the ICO (if notifiable) and log internally, but direct notification isn't required.

How can Lunyb help after a breach?

Lunyb gives you breach alerts for your email and phone, a scam checker for suspicious messages, an encrypted password and photo vault, on-device threat blocking, and a privacy audit of your apps. It's the fastest way to move from "I've been breached" to "I'm back in control" without juggling five separate tools.

Take Control of Your Privacy Today

Reporting a breach to the ICO is a legal obligation. Preventing the next one, and protecting yourself from the fallout of someone else's mistake, is a choice you make every day. Lunyb makes that choice easy.

Head to lunyb.com to take our free privacy quiz, see where your data is exposed, and start protecting yourself in minutes. Or download the Lunyb app from the App Store or Google Play and get breach alerts, scam protection, and your personal security score up and running today.

If you're researching other privacy tools too, you might find our honest breakdowns useful: Is Lunyb Legit? Honest Review of the Privacy-First URL Shortener (2026) and Rebrandly Review 2026: Is It Worth the Price (or Try Lunyb)?.