How to Report a Data Breach to the ICO: A Step-by-Step UK Guide

If your organisation has suffered a personal data breach, UK GDPR gives you just 72 hours to notify the Information Commissioner's Office (ICO). Miss that window, mishandle the notification, or fail to document your decision properly, and you could face enforcement action, reputational damage, and fines of up to £17.5 million or 4% of global annual turnover. This guide walks you through exactly how to report a data breach to the ICO, when you must do it, and what happens after you submit.

What Counts as a Personal Data Breach Under UK GDPR?

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is not limited to cyberattacks — it includes lost laptops, misdirected emails, stolen paperwork, and even accidental deletion.

The ICO recognises three categories of breach:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data (for example, a phishing attack or an email sent to the wrong recipient).
• Integrity breach — unauthorised or accidental alteration of personal data (for example, a ransomware attack that corrupts records).
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (for example, a server failure with no backup).

Importantly, a breach is still a breach even if the data is encrypted, lost temporarily, or recovered quickly. What changes is whether it must be reported to the ICO.

When Must You Report a Data Breach to the ICO?

You must report a personal data breach to the ICO within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. The clock starts the moment any member of your organisation has a reasonable degree of certainty that a security incident has occurred and personal data is affected — not when the IT team finishes its investigation.

The Risk Assessment Test

Before reporting, you must assess the likely risk to data subjects. Consider:

1. Type of breach — confidentiality, integrity, or availability.
2. Nature, sensitivity, and volume of personal data — special category data (health, biometrics, political opinions) and financial data carry higher risk.
3. Ease of identifying individuals — was the data pseudonymised or encrypted?
4. Severity of consequences — risks like identity theft, fraud, financial loss, discrimination, reputational damage, or physical harm.
5. Special characteristics of the individual — children and vulnerable adults warrant extra caution.
6. Number of affected individuals — larger populations generally mean greater aggregate risk.

If the risk is unlikely, you don't need to notify the ICO — but you must still document the breach internally. If in doubt, report. The ICO explicitly states it would rather receive borderline reports than miss serious ones.

When You Must Also Notify Affected Individuals

If the breach is likely to result in a high risk to rights and freedoms, you must also notify the affected data subjects "without undue delay." This is a higher threshold than ICO notification. The ICO's own breach report form will prompt you to confirm whether individuals have been or will be notified.

Step-by-Step: How to Report a Data Breach to the ICO

The ICO offers two main reporting routes: an online self-report form and a telephone helpline. Here is the full process from detection to submission.

Step 1: Contain and Assess

Before anything else, stop the bleeding. Revoke compromised credentials, isolate affected systems, recall misdirected emails where possible, and preserve evidence. Convene your incident response team and begin a factual timeline. Do not delay reporting while you investigate — partial notifications are acceptable and expected.

Step 2: Determine the Reporting Route

• Non-cyber breaches (lost paperwork, misdirected post, verbal disclosures) — use the ICO's online "Report a breach" form on ico.org.uk.
• Cyber breaches (ransomware, phishing, hacking, DDoS) — use the dedicated cyber incident reporting form, which asks additional technical questions.
• Urgent cases outside office hours — call the ICO helpline on 0303 123 1113 (Monday to Friday, 9am to 5pm). Outside those hours, submit online and the ICO will respond on the next working day.

Step 3: Gather the Required Information

The ICO form requires you to provide:

1. Your organisation's name, ICO registration number, and sector.
2. Contact details for your Data Protection Officer (DPO) or breach contact.
3. When the breach occurred and when you became aware of it.
4. Nature of the breach — what happened, how, and why.
5. Categories and approximate number of data subjects affected.
6. Categories and approximate number of personal data records affected.
7. Likely consequences for individuals.
8. Measures taken or proposed to address the breach and mitigate harm.
9. Whether you have notified, or intend to notify, affected individuals — and if not, why.

If you don't have all the information within 72 hours, submit what you have and flag it as a phased or partial notification. You can update the ICO as the investigation progresses.

Step 4: Submit and Record Your Reference Number

Once submitted, the ICO issues a case reference. Store this with your breach documentation. If you need to send follow-up information, quote this reference.

Step 5: Document Everything Internally

Article 33(5) of UK GDPR requires you to maintain an internal breach register regardless of whether you report externally. Record the facts of the breach, its effects, remedial action, and your decision-making rationale. The ICO can request this register during any investigation or audit.

What Happens After You Submit the Report?

The ICO reviews every notification and decides on a proportionate response. Possible outcomes include:

ICO Response	What It Means	Typical Trigger
No further action	ICO logs the breach and takes no further steps.	Low-risk breach, swift containment, good controls.
Advisory letter	Written recommendations with no formal penalty.	Minor failings in process or training.
Investigation	ICO requests documents, interviews staff, audits systems.	Large-scale breach or systemic failings suspected.
Reprimand	Formal public rebuke recorded on ICO's website.	Clear UK GDPR breach but limited harm.
Enforcement notice	Legal order to take specific remedial action.	Ongoing non-compliance.
Monetary penalty	Fine up to £17.5m or 4% of global turnover.	Serious, negligent, or repeat breaches.

Most reported breaches do not result in fines. The ICO's enforcement approach emphasises proportionality, cooperation, and the organisation's conduct before, during, and after the incident.

Common Mistakes When Reporting a Breach

Even well-prepared organisations trip up during the stress of an incident. Watch out for these pitfalls:

• Starting the 72-hour clock too late. Awareness begins when the organisation reasonably knows a breach has occurred, not when leadership is formally briefed.
• Over-reporting trivial incidents. Every misdirected internal email does not need reporting. Use the risk-assessment framework.
• Under-reporting to avoid scrutiny. Failing to report a notifiable breach is itself a separate infringement and attracts higher penalties if discovered.
• Vague or defensive language. Be factual and transparent. The ICO responds better to candid reporting than evasive wording.
• Forgetting to notify individuals. ICO notification is only half the duty when high risk is involved.
• No internal register. Even unreported breaches must be documented.
• Ignoring processor obligations. If you are a data processor, you must notify the controller "without undue delay" — the controller then handles ICO notification.

How to Prevent Future Breaches

Reporting is reactive. Prevention is where real compliance lives. A mature approach combines technical controls, staff training, and vendor management.

Technical and Organisational Measures

1. Encrypt data at rest and in transit. Properly encrypted data that is lost may not meet the notification threshold if the key is secure.
2. Enforce multi-factor authentication on every account with access to personal data.
3. Apply least-privilege access and review permissions quarterly.
4. Patch promptly — most ransomware exploits known vulnerabilities with available fixes.
5. Maintain tested backups stored offline or in immutable storage.
6. Use secure link-sharing tools. When sharing documents or campaign URLs externally, use a trusted shortener like Lunyb that offers HTTPS, click analytics, and link expiry rather than exposing raw internal URLs. For a broader comparison, see our 2026 URL shortener buyer's guide.
7. Deploy email data-loss prevention (DLP) to catch misdirected messages before they leave.

Governance and Training

• Appoint a DPO or named breach lead with clear authority.
• Run tabletop breach exercises at least annually.
• Train every member of staff on breach recognition and reporting — most breaches are first spotted by frontline employees.
• Keep an up-to-date record of processing activities (ROPA) so you can quickly identify affected data categories.
• Review processor contracts to ensure clear breach-notification timelines, often 24 or 48 hours internally so the controller still has time to notify the ICO.

Special Scenarios

Cross-Border Breaches

Since the UK left the EU, UK-established organisations report to the ICO. If you also operate in the EU, you may need to notify a lead EU supervisory authority separately under EU GDPR. The one-stop-shop no longer applies to UK controllers.

Breaches by a Processor

Processors must notify the controller without undue delay. The 72-hour clock for ICO notification begins when the controller becomes aware — practically, this means the moment the processor informs them.

Telecoms and Service Providers

Under the Privacy and Electronic Communications Regulations (PECR), communications service providers must notify the ICO within 24 hours of any personal data breach, using a different form. This is additional to, not instead of, UK GDPR obligations where relevant.

Frequently Asked Questions

What is the deadline to report a data breach to the ICO?

You must report a notifiable personal data breach to the ICO within 72 hours of becoming aware of it. If you miss the deadline, you can still report but must explain the delay. Late reporting is itself an infringement and may increase any penalty.

Do I have to report every data breach?

No. Only breaches likely to result in a risk to the rights and freedoms of individuals must be reported. Low-risk incidents — such as an internal email with limited, non-sensitive data sent to the wrong colleague who deletes it — generally do not meet the threshold. You must still record them internally.

What happens if I don't report a breach that I should have?

Failing to notify a notifiable breach is a separate infringement under Article 33 UK GDPR and can attract fines of up to £8.7 million or 2% of global annual turnover. The ICO treats cover-ups particularly severely, and discovery often happens through complaints, media reports, or whistleblowers.

Can I report a breach anonymously or on behalf of someone else?

Organisations cannot report anonymously — the ICO needs to identify the controller. However, if you are an individual whose data has been mishandled, you can raise a concern with the ICO through its public complaints process rather than the breach-reporting form. Journalists and whistleblowers can also contact the ICO directly.

How long does the ICO take to respond after I submit a breach report?

The ICO typically acknowledges receipt within a few working days. A full response — whether that is "no further action," a request for more information, or the opening of an investigation — usually arrives within 30 days for straightforward cases. Complex or large-scale breaches can take several months.

Should I notify affected individuals before or after notifying the ICO?

There is no strict order, but in practice ICO notification often happens first because the 72-hour deadline is firm. Individual notification is required "without undue delay" where high risk exists, so the two frequently happen in parallel. Prepare both communications simultaneously.

Reporting a breach to the ICO is stressful, but a prompt, honest, and well-documented notification almost always produces a better outcome than silence. Build the muscle memory before you need it — rehearse your response plan, know who in your team will fill out the form, and keep the ICO helpline number somewhere everyone can find it.