How to Report a Data Breach to the ICO: A Step-by-Step UK Guide

If your organisation has suffered a personal data breach, UK law requires you to act fast. Under the UK GDPR and the Data Protection Act 2018, most notifiable breaches must be reported to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of them. Miss that window, and you risk regulatory action, reputational damage, and fines of up to £17.5 million or 4% of global annual turnover.

This guide walks you through exactly how to report a data breach to the ICO, what information you'll need, when a breach is actually notifiable, and how to handle the aftermath. Whether you're a data protection officer, small business owner, or IT manager encountering your first incident, this article gives you a practical, compliant roadmap.

What Counts as a Personal Data Breach?

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It isn't limited to hackers stealing databases — it covers a surprisingly wide range of events.

The ICO identifies three broad categories of breach:

Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data (e.g. sending an email to the wrong recipient).
Integrity breach — unauthorised or accidental alteration of personal data (e.g. a database being corrupted or tampered with).
Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (e.g. a ransomware attack encrypting customer records).

Common real-world examples include lost laptops containing unencrypted customer data, misdirected emails with attached spreadsheets, phishing attacks that expose employee credentials, misconfigured cloud storage buckets, and stolen paper files from an office.

When Must You Report a Data Breach to the ICO?

You must notify the ICO within 72 hours of becoming "aware" of a personal data breach — unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. The clock starts the moment you have a reasonable degree of certainty that a breach has occurred, not when you finish investigating.

Risk Assessment: Is Your Breach Notifiable?

Before reporting, assess whether the breach poses a risk to individuals. Factors to consider include:

Type of breach — was data disclosed, lost, or altered?
Nature and volume of personal data — special category data (health, biometrics, political views) carries far higher risk.
Ease of identifying individuals — was the data encrypted or pseudonymised?
Severity of consequences — could it lead to identity theft, fraud, discrimination, or financial loss?
Number of individuals affected — larger numbers typically mean greater regulatory interest.
Special characteristics of individuals — children and vulnerable people warrant extra caution.

If the risk is low — for example, you accidentally emailed a non-sensitive internal newsletter to one wrong colleague — you may not need to report. But you must still document the incident internally. If in doubt, report. The ICO would rather receive a report than discover an unreported breach later.

When You Must Also Notify Affected Individuals

If the breach is likely to result in a high risk to individuals' rights and freedoms, you must also notify those individuals directly, without undue delay. Communication should be in clear, plain language and include the nature of the breach, likely consequences, and steps they can take to protect themselves.

Information You'll Need Before Reporting

The ICO's breach reporting form asks for specific details. Gathering these in advance speeds up the submission and ensures accuracy. Prepare the following:

Category	Details Required
Organisation details	Legal name, ICO registration number, sector, contact details of the DPO or lead contact
Breach timing	Date and time breach occurred, date and time you became aware, how it was discovered
Nature of breach	Confidentiality, integrity, or availability — and brief description
Personal data involved	Categories of data (names, addresses, financial, health, etc.) and approximate number of records
Individuals affected	Categories (customers, employees, children) and approximate number
Likely consequences	Potential harm such as identity theft, financial loss, distress
Measures taken	Containment steps, remediation, mitigation of harm
Cross-border aspects	Whether individuals in other EEA countries are affected

How to Report a Data Breach to the ICO: Step-by-Step

The ICO offers several reporting channels. The method you choose depends on the urgency and severity of the breach.

Step 1: Contain the Breach

Before anything else, stop the bleeding. Revoke compromised credentials, isolate affected systems, recall misdirected emails if possible, and secure physical records. Document every action taken and the time it was completed.

Step 2: Assess the Risk

Using the risk factors outlined earlier, determine whether the breach is notifiable to the ICO, to individuals, or both. Record your reasoning — the ICO expects to see a documented decision-making process even for breaches you decide not to report.

Step 3: Choose Your Reporting Channel

The ICO provides three main routes:

Online report form — available at ico.org.uk, suitable for most breaches. You'll receive a reference number on submission.
Telephone helpline — call 0303 123 1113 (option 3) between 9am and 5pm, Monday to Friday. Recommended for serious or urgent breaches, including cyber incidents in progress.
Live chat — available on the ICO website for guidance (not a formal reporting channel).

Step 4: Complete the Online Reporting Form

The ICO's self-assessment tool walks you through a series of questions and determines whether the breach needs to be reported. If it does, you'll be guided to the full reporting form. Fill in each section carefully, using the information you prepared earlier. If you don't have all the details within 72 hours, submit what you have and provide additional information in phases — this is explicitly permitted under Article 33(4) of the UK GDPR.

Step 5: Save Your Reference Number

Once submitted, you'll receive an email confirmation with a reference number. Store this safely alongside your internal breach record. The ICO may contact you for further information within a few working days.

Step 6: Notify Affected Individuals (If Required)

For high-risk breaches, contact affected individuals directly using a clear, honest message. Email is usually acceptable, though for very serious incidents a letter or in-app notification may be more appropriate. Include practical advice — for example, resetting passwords, monitoring bank statements, or watching for phishing attempts.

Step 7: Document Everything

Keep a comprehensive internal breach log recording the facts, effects, remedial action, and your reasoning for every decision. The ICO can request this record at any time, and it's a fundamental accountability obligation under Article 33(5).

What Happens After You Report?

Once your report is submitted, the ICO will acknowledge receipt and assign a case officer if the breach warrants further investigation. Possible outcomes include:

No further action — if the breach was handled appropriately and risk was low.
Advice and guidance — the ICO may issue recommendations to improve your controls.
Formal investigation — for larger or more serious incidents, the ICO may request documentation, interview staff, or inspect systems.
Enforcement action — including reprimands, enforcement notices, or monetary penalties for serious or repeat failings.

Cooperation is critical. Organisations that are transparent, act swiftly, and demonstrate genuine improvements typically face lighter outcomes than those that stonewall or delay.

Common Mistakes to Avoid

Many organisations stumble in predictable ways during breach reporting. Avoid these pitfalls:

Delaying beyond 72 hours while trying to gather a "complete" picture — submit a partial report and update later.
Over-reporting trivial incidents — not every error is a notifiable breach; document and move on where appropriate.
Under-reporting serious incidents out of embarrassment or fear of penalties — this almost always makes things worse.
Poor record-keeping — if you can't show your decision-making, the ICO assumes the worst.
Vague individual notifications that fail to tell people what happened or what to do.
Not learning from the breach — failing to update policies, training, or technology after an incident.

Preventing the Next Breach

Reporting is reactive. The real goal is reducing the likelihood and impact of future incidents. Strong preventive measures include staff training on phishing and data handling, encryption of devices and portable media, access controls based on least privilege, regular backups and tested recovery procedures, and secure link-sharing practices for sensitive URLs. Tools like Lunyb can help by offering password-protected and expiring short links, so that even if a URL leaks, exposure is limited by time or authentication. For a broader comparison of link management options, see our 2026 buyer's guide to URL shorteners.

Alongside technical controls, maintain a tested incident response plan. Run tabletop exercises so your team knows exactly who does what when the alarm sounds. The organisations that handle breaches best aren't the ones that never have incidents — they're the ones that have rehearsed the response.

Breach Reporting at a Glance

Scenario	Notify ICO?	Notify Individuals?	Timeframe
Low-risk breach (e.g. internal email to wrong colleague, no sensitive data)	No (document internally)	No	N/A
Risk to rights and freedoms (e.g. customer list leaked)	Yes	Optional, risk-dependent	Within 72 hours
High risk (e.g. financial data, health records exposed)	Yes	Yes, without undue delay	Within 72 hours; individuals ASAP
Processor discovers breach	Notify controller immediately	Controller's responsibility	Without undue delay

Frequently Asked Questions

What is the 72-hour deadline for reporting a data breach to the ICO?

Under the UK GDPR, you must notify the ICO within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights and freedoms. If you can't provide all the details in time, submit an initial report and follow up with additional information in phases.

What happens if I report a breach late?

You must explain the reasons for the delay as part of your report. The ICO may still accept your submission but will take the delay into account when assessing your overall handling of the incident. Repeated or unexplained delays can lead to enforcement action, including fines.

Do I need to report every data breach to the ICO?

No. Only breaches that are likely to result in a risk to the rights and freedoms of individuals must be reported. Low-risk incidents still need to be documented internally, but you don't need to notify the regulator. Use the ICO's online self-assessment tool if you're unsure.

Can I be fined for a data breach even if I report it?

Yes, but reporting promptly and transparently usually results in a more favourable outcome. The ICO considers factors such as the nature of the breach, your technical and organisational measures, cooperation, and whether you've taken steps to prevent recurrence. Fines are typically reserved for serious failings, not for the breach itself.

Who in my organisation should report the breach?

Your Data Protection Officer (DPO) typically leads breach reporting if you have one. Otherwise, the responsibility usually falls to a senior person with authority over data protection — such as a compliance manager, head of IT, or company director. The named contact on the report should be reachable for follow-up questions from the ICO.