How to Report a Data Breach to the ICO: A Complete UK Guide

If your organisation has suffered a personal data breach, UK GDPR gives you just 72 hours to notify the Information Commissioner's Office (ICO). Missing this window — or getting the submission wrong — can lead to significant fines, reputational damage, and loss of customer trust. This guide walks you through exactly how to report a data breach to the ICO, what information you need, and how to handle the aftermath properly.

What Counts as a Reportable Data Breach Under UK GDPR?

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Not every incident needs to be reported to the ICO — only those likely to result in a risk to the rights and freedoms of individuals.

There are three main categories of breach recognised by the ICO:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data (e.g. an email sent to the wrong recipient).
• Integrity breach — unauthorised or accidental alteration of personal data (e.g. a database being tampered with).
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (e.g. ransomware encrypting customer records).

Examples That Must Be Reported

• A laptop containing unencrypted customer data is stolen.
• A phishing attack results in an employee's mailbox being accessed by a third party.
• A misconfigured cloud bucket exposes thousands of customer records.
• Payroll data is emailed to the wrong supplier.
• A website vulnerability allows attackers to download user accounts.

Examples That May Not Need Reporting

• An encrypted laptop is lost but the data cannot be accessed and backups exist.
• An internal email containing low-risk data is sent to the wrong colleague who confirms deletion.
• A brief system outage with no data loss or exposure.

Even if you decide not to report, you must document your reasoning in an internal breach log — the ICO can and does ask to see this.

The 72-Hour Rule: When Does the Clock Start?

Under Article 33 of the UK GDPR, controllers must notify the ICO "without undue delay and, where feasible, not later than 72 hours after having become aware" of a personal data breach. The clock starts the moment you have a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.

Key points about the timeline:

1. Awareness is not suspicion. Initial reports from staff or alerts from monitoring tools trigger investigation, not necessarily the clock.
2. 72 hours includes weekends and bank holidays. A breach discovered on Friday afternoon still needs notification by Monday afternoon.
3. Phased reporting is allowed. If you don't have all the facts within 72 hours, submit what you know and update the ICO as the investigation progresses.
4. Late reporting must be justified. If you miss the deadline, you must explain why when you do notify.

Step-by-Step: How to Report a Data Breach to the ICO

The ICO offers two main reporting channels: an online self-assessment and reporting tool, and a dedicated helpline. For most organisations, the online route is faster and creates a written record.

Step 1: Contain and Assess the Breach

Before you report, take immediate steps to contain the incident. Isolate affected systems, revoke compromised credentials, and preserve evidence. Then assess the scope: what data was involved, how many individuals are affected, and what is the likely harm?

Step 2: Use the ICO's Self-Assessment Tool

Visit ico.org.uk and navigate to "Report a breach." The self-assessment asks a series of questions to help you determine whether notification is required. If it is, you'll be guided into the full reporting form.

Step 3: Complete the Online Notification Form

You'll need to provide the following information:

• Your organisation's name, sector, and ICO registration number.
• Details of the Data Protection Officer (DPO) or main contact.
• When the breach occurred and when you became aware of it.
• Description of the breach (what happened, how, and the categories of personal data involved).
• Approximate number of data subjects and records affected.
• Likely consequences for individuals.
• Measures taken or proposed to address the breach and mitigate harm.

Step 4: Call the ICO Helpline if Urgent or Complex

For serious or complex breaches — particularly those involving special category data, children, or large numbers of individuals — you can call the ICO's personal data breach helpline on 0303 123 1113 (option 3). It's open Monday to Friday, 9am to 5pm. Outside these hours, use the online form.

Step 5: Submit and Save the Reference Number

Once submitted, you'll receive a reference number. Keep this safe — you'll need it for any follow-up correspondence, phased updates, or if the ICO opens an investigation.

What Information the ICO Expects

The quality of your notification matters as much as the timing. The ICO expects controllers to demonstrate they understand what happened and are taking it seriously. Here's what a well-structured notification includes:

Section	What to Include
Nature of breach	Confidentiality, integrity, or availability; cause (human error, cyber attack, system failure)
Data categories	Names, contact details, financial data, special category data, children's data
Scale	Number of individuals and records affected (estimates acceptable if full numbers unknown)
Consequences	Risk of identity theft, financial loss, discrimination, reputational harm, physical safety
Mitigation	Containment actions, remedial measures, support offered to affected individuals
Communication plan	Whether and how you'll notify data subjects

When Must You Notify the Affected Individuals?

Article 34 of the UK GDPR requires you to notify affected individuals directly when a breach is likely to result in a high risk to their rights and freedoms. This is a higher threshold than ICO notification, but it still catches many serious incidents.

Your notification to individuals must:

• Be written in clear, plain language — no legalese.
• Describe the nature of the breach.
• Provide the name and contact details of your DPO or breach contact.
• Describe the likely consequences.
• Describe the measures taken and recommended actions (e.g. change passwords, monitor accounts).

You can be exempted from direct notification if you've applied strong encryption that renders the data unintelligible, if subsequent measures mean high risk is no longer likely, or if direct contact would involve disproportionate effort (in which case a public communication is acceptable).

Common Mistakes to Avoid

From ICO enforcement notices and published decisions, these are the mistakes that most often turn a manageable breach into a regulatory headache:

1. Delaying notification while "investigating." You don't need all the facts to submit — initial notification can be phased.
2. Underestimating the scale. Report conservative estimates and update them, rather than lowballing to seem less serious.
3. Failing to document. Every breach — reportable or not — must be logged with the facts, effects, and remedial action.
4. Poor internal escalation. Staff who first discover the incident must know who to tell immediately.
5. Not notifying affected individuals when required. Hoping no one notices is not a defence.
6. Treating processors as separate. If your processor suffers a breach involving your data, you — the controller — are responsible for notifying the ICO.

How to Prepare Before a Breach Happens

Organisations that handle breaches well have usually prepared in advance. Reactive scrambling at hour 20 of 72 rarely produces a good outcome.

Build a Breach Response Plan

Your plan should name responsible individuals, define escalation routes, set internal reporting timelines (ideally within 24 hours of discovery), and include template communications for the ICO, data subjects, and the press.

Train Your Team

Every employee should know what a personal data breach looks like and how to report it internally. Phishing simulations, tabletop exercises, and short refresher training all help.

Keep a Breach Log

Maintain a central register of all incidents — including those you decided not to report. The log should capture facts, impact assessment, decisions taken, and the rationale.

Review Your Technical Controls

Encryption, access controls, logging, and monitoring all affect both the likelihood of a breach and your ability to assess one quickly. Simple hygiene — such as using secure, privacy-respecting link tools like Lunyb when sharing resources with staff or customers — reduces the number of places sensitive URLs and tracking data are exposed. For a broader comparison of trusted link platforms, see our 2026 URL shortener buyer's guide.

What Happens After You Report?

Submitting a notification doesn't automatically trigger an investigation. The ICO reviews your report and decides whether further action is needed. Possible outcomes include:

• No further action — the ICO is satisfied with your handling and closes the case.
• Request for more information — you'll be asked to clarify specific points or provide documentation.
• Formal investigation — for serious or systemic issues, the ICO may launch a full investigation.
• Enforcement action — reprimands, enforcement notices, or monetary penalties (up to £17.5 million or 4% of global turnover, whichever is higher).

In most cases, a well-handled breach that was reported promptly, documented clearly, and remediated effectively results in no enforcement action at all. The ICO's priority is protecting individuals, not punishing good-faith responders.

Frequently Asked Questions

Do I need to report a breach if no data was actually accessed?

If personal data was exposed but you have strong evidence it wasn't accessed or exfiltrated — such as detailed audit logs showing no unauthorised activity — the risk to individuals may be low enough that reporting isn't required. Document your reasoning thoroughly in your breach log, as the ICO may ask about it later.

What happens if I miss the 72-hour deadline?

You should still report the breach as soon as possible and provide reasons for the delay. Late reporting is not an automatic penalty, but unexplained or repeated delays can lead to enforcement action. Being transparent about why the deadline was missed — for example, due to the complexity of the investigation — is far better than attempting to conceal the issue.

Is a data breach the same as a cyber attack?

No. A cyber attack is one potential cause of a data breach, but breaches also occur through human error (misdirected emails, lost devices), physical theft, insider misuse, and system failures. The reporting obligation depends on whether personal data was compromised, not on the method of compromise.

Who is responsible for reporting — the controller or the processor?

The data controller is legally responsible for reporting to the ICO. Processors must notify the controller "without undue delay" after becoming aware of a breach, and the controller then assesses whether ICO notification is required. Your processor contracts should specify notification timelines (typically 24 hours or less).

Can I report a breach anonymously?

No. Formal breach notifications from controllers must identify the organisation and a responsible contact. However, individuals who believe their data has been mishandled can raise concerns with the ICO separately, and whistleblowers have specific legal protections.

Do I need to notify the ICO if the breach involves data from another EU country?

Since Brexit, the ICO is the lead authority for UK data subjects. If your organisation also processes data of EU residents, you may need to notify the relevant EU supervisory authority as well under the EU GDPR. For cross-border incidents, taking legal advice early is strongly recommended.

Final Thoughts

Reporting a data breach to the ICO isn't just a legal obligation — it's an opportunity to demonstrate accountability and rebuild trust. Organisations that respond quickly, communicate honestly, and take meaningful remedial action generally emerge with their reputation intact. The ones that stall, downplay, or hide incidents are the ones that end up on the ICO's enforcement page.

Prepare before you need to, log everything, and when the moment comes, notify within 72 hours. Treat the breach as a learning event and your organisation will be stronger — and more trusted — on the other side.