How to Report a Data Breach to the ICO: A Complete UK Guide

If your organisation has suffered a personal data breach in the UK, you may have a legal duty to notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it. Failing to report when required can lead to significant fines under the UK GDPR and Data Protection Act 2018. This guide walks you through exactly when, how and what to report to the ICO, what information you'll need, and what happens after you submit.

What Is a Personal Data Breach Under UK GDPR?

A personal data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It isn't just about hackers — a lost laptop, a misdirected email, or an employee accessing records they shouldn't all qualify.

The ICO recognises three main categories of breach:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
• Integrity breach — unauthorised or accidental alteration of personal data.
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (for example, a ransomware attack).

Common Examples of Reportable Breaches

• A customer database stolen through a cyber attack.
• A ransomware incident that encrypts personal data.
• An email containing personal details sent to the wrong recipient.
• A lost or stolen unencrypted USB stick, phone or laptop.
• Documents containing personal data left on a train or in a public place.
• A staff member accessing HR records without authorisation.

When Do You Have to Report a Data Breach to the ICO?

Under Article 33 of the UK GDPR, data controllers must notify the ICO of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it — unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

The 72-hour clock starts when you have a reasonable degree of certainty that a security incident has occurred and that personal data has been affected — not from when the breach first happened.

The Risk Threshold Test

You must report if the breach is likely to result in a risk to people's rights and freedoms. Consider:

1. Type of breach — confidentiality, integrity or availability.
2. Nature, sensitivity and volume of personal data involved (e.g. special category data such as health or financial records carries higher risk).
3. Ease of identification of individuals from the data.
4. Severity of consequences — financial loss, identity theft, reputational damage, discrimination.
5. Special characteristics of affected individuals (children, vulnerable people).
6. Number of affected individuals.

If the risk is high, you must also notify affected individuals directly without undue delay (Article 34).

When You Don't Need to Report

You don't need to notify the ICO if the breach is unlikely to pose a risk — for example, if the lost data was strongly encrypted, if it was quickly recovered before any access occurred, or if the data was already publicly available. However, you must still record the incident internally.

Step-by-Step: How to Report a Data Breach to the ICO

Here's the full process to follow once you've confirmed a reportable breach:

Step 1: Contain and Assess the Breach

Before notifying, take immediate action to contain the breach — isolate affected systems, change passwords, revoke access, recall misdirected emails. Then begin assessing the scope: what data, how many individuals, what risks.

Step 2: Document Everything Internally

Even breaches you don't report must be logged. Create a breach record that includes:

• Date and time the breach occurred and was discovered.
• How you became aware of it.
• Nature of the personal data involved.
• Approximate number of individuals and records affected.
• Likely consequences.
• Mitigation measures taken.

Step 3: Choose Your Reporting Method

The ICO offers several ways to report:

• Online self-assessment and reporting tool at ico.org.uk — the recommended method.
• Telephone: 0303 123 1113 (open 9am to 5pm, Monday to Friday) — useful for urgent out-of-hours cases, though online submission is still required.
• Report by post only if digital submission isn't possible.

Step 4: Complete the Online Breach Report Form

The ICO's online form will ask for:

1. Your organisation details and contact information for the Data Protection Officer (DPO) or breach lead.
2. Description of the breach — what happened, when, how.
3. Categories and approximate number of data subjects affected.
4. Categories and approximate number of personal data records concerned.
5. Likely consequences for individuals.
6. Measures taken or proposed to address the breach and mitigate adverse effects.
7. Whether affected individuals have been or will be informed.

Step 5: Submit a Phased Report if Needed

If you don't have all the information within 72 hours, submit what you have and clearly state that further details will follow. The ICO accepts phased notifications — missing the deadline entirely is worse than submitting incomplete information on time. If you report late, explain the reasons for the delay.

Step 6: Notify Affected Individuals (If High Risk)

If the breach poses a high risk, inform affected individuals in clear, plain language. Your communication should include:

• A description of the breach.
• Name and contact details of your DPO.
• Likely consequences.
• Measures taken and recommended actions for the individual (e.g. change passwords, monitor accounts).

Step 7: Keep Records and Cooperate With the ICO

Retain all evidence and respond promptly to any ICO follow-up questions. The regulator may request additional information, impose remedial measures or, in serious cases, open a formal investigation.

Information You'll Need Before You Submit

Preparing this checklist before opening the form will save time:

Category	Details Required
Organisation	Name, ICO registration number, address, sector
Contact	DPO or breach contact name, email, phone
Breach timeline	Date of incident, date of discovery, date of containment
Data involved	Categories (names, addresses, financial, health, etc.), volume
People affected	Numbers, categories (customers, staff, children, vulnerable)
Cause	Cyber attack, human error, system failure, lost device
Impact	Likely consequences and severity
Mitigation	Containment steps, remediation plans, individual notification

Penalties for Failing to Report

Not reporting a notifiable breach within the required timeframe is itself a breach of UK GDPR. The ICO can impose administrative fines of up to £8.7 million or 2% of annual global turnover, whichever is higher. More serious infringements — such as failing to protect data adequately — can attract fines of up to £17.5 million or 4% of annual global turnover.

Beyond fines, consequences include:

• Reputational damage and loss of customer trust.
• Civil claims from affected individuals.
• Enforcement notices requiring specific remedial action.
• Audits and ongoing regulatory scrutiny.

Reducing the Risk of Future Breaches

The best breach report is the one you never have to file. Build these practices into your operations:

Technical Measures

• Encrypt data at rest and in transit.
• Enforce multi-factor authentication across all systems.
• Keep software patched and conduct regular vulnerability scans.
• Use encrypted DNS and private browsers for staff handling sensitive data.
• Segment networks so a single compromise doesn't expose everything.
• Maintain tested, offline backups.

Organisational Measures

• Appoint a DPO or data protection lead with clear authority.
• Maintain a Record of Processing Activities (ROPA).
• Run regular staff training on phishing, data handling and incident reporting.
• Have a written incident response plan with named responsibilities.
• Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing.
• Vet processors and ensure contracts include breach notification clauses.

Safer Link Sharing

Many breaches start with phishing links or exposed URLs leaking internal data. When your team shares links externally — in emails, documents or marketing materials — use a trusted shortener that offers HTTPS, link expiry and password protection rather than exposing raw internal URLs. Services like Lunyb let you create branded, trackable short links with privacy controls, which is a small but useful piece of the wider data-protection puzzle. If you're evaluating options, see our 2026 buyer's guide to URL shorteners for a side-by-side comparison.

Special Scenarios

Breaches Involving a Data Processor

If a processor (e.g. a cloud provider) suffers the breach, they must notify the controller without undue delay. The controller — not the processor — is responsible for notifying the ICO. Ensure your processor contracts include tight notification timelines (ideally 24 hours) so you can still meet the 72-hour deadline.

Cross-Border Breaches

If your organisation operates across the UK and EU, you may need to notify both the ICO and relevant EU supervisory authorities. The lead supervisory authority mechanism no longer applies between the UK and EU post-Brexit, so parallel notifications are often necessary.

Breaches at Small Organisations

Size doesn't exempt you. Sole traders, charities and SMEs are subject to the same rules. The ICO does, however, take proportionality and resources into account when deciding enforcement action.

After You Report: What to Expect

Once submitted, you'll receive an acknowledgement with a case reference. The ICO's response depends on severity:

• Low severity: Case may be closed with no further action beyond logging.
• Medium severity: ICO may request further information or recommend improvements.
• High severity: Formal investigation, potential enforcement notice, or monetary penalty.

Most reported breaches do not result in fines. The ICO prioritises cooperation and remediation, particularly where the organisation has acted transparently and quickly.

Frequently Asked Questions

Does the 72-hour deadline include weekends and bank holidays?

Yes. The 72-hour window is continuous and includes weekends and public holidays. Build on-call cover into your incident response plan so breaches discovered on a Friday evening can still be reported on time.

What if I'm not sure whether to report?

Use the ICO's online self-assessment tool, which guides you through the risk evaluation. If still in doubt, err on the side of reporting — the ICO would rather hear about a borderline case than discover you failed to notify. You can also call the ICO helpline on 0303 123 1113 for guidance.

Do I have to tell customers about every breach?

No. You only need to notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms. For lower-risk incidents, internal records and ICO notification (if applicable) are sufficient. However, transparency often benefits trust even when not legally required.

Can I be fined just for being late, even if the breach wasn't serious?

Yes, in principle. Late reporting is itself an infringement. In practice, the ICO weighs the delay against the circumstances — a short, well-explained delay with full cooperation is unlikely to attract a fine, whereas a deliberate concealment almost certainly will.

How long should I keep records of data breaches?

There is no fixed statutory retention period, but the ICO expects you to maintain internal breach records for long enough to demonstrate compliance — typically at least as long as any related personal data is held, and often several years thereafter. Many organisations retain breach logs for a minimum of six years.

Final Thoughts

Reporting a data breach to the ICO is less about ticking a regulatory box and more about demonstrating that your organisation takes personal data seriously. Act fast, document thoroughly, communicate honestly, and treat every incident as a chance to tighten your controls. With a clear incident response plan, the right technical safeguards and a trained team, the 72-hour deadline becomes manageable rather than terrifying.