How to Report a Data Breach to the ICO: UK Guide for 2026

If your organisation has suffered a personal data breach, UK GDPR requires you to act fast. In most cases, you must report a notifiable breach to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it. This guide walks you through exactly how to report a data breach to the ICO, what counts as notifiable, which form to use, and how to avoid the mistakes that lead to regulatory action.

What Is a Personal Data Breach Under UK GDPR?

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is broader than a cyberattack and includes everyday mistakes.

Under Article 4(12) of the UK GDPR, breaches fall into three overlapping categories:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data (for example, sending an email to the wrong recipient).
• Integrity breach — unauthorised or accidental alteration of personal data.
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (for example, a ransomware attack or a lost laptop).

Not every breach needs to be reported to the ICO, but every breach must be documented internally, regardless of whether it meets the reporting threshold.

When Must You Report a Data Breach to the ICO?

You must notify the ICO when a personal data breach is likely to result in a risk to the rights and freedoms of individuals. If the risk is high, you must also notify the affected individuals without undue delay.

The 72-Hour Rule

The clock starts when you become "aware" of the breach — meaning you have a reasonable degree of certainty that a security incident has occurred and that personal data is affected. It does not start the moment the incident happened or the moment a junior employee first saw something odd.

You have 72 hours from awareness to notify the ICO. If you miss the deadline, you can still report, but you must explain the reasons for the delay.

Risk Assessment: Is It Notifiable?

Ask the following questions when deciding whether to report:

1. What type of personal data is involved? Special category data (health, biometric, racial, political, religious) raises the risk significantly.
2. How many individuals are affected?
3. What are the likely consequences — identity theft, financial loss, reputational damage, discrimination, physical harm?
4. How easily can affected individuals be identified from the breached data?
5. Has the data been encrypted or otherwise rendered unintelligible?

If in doubt, the ICO's position is clear: report it. Over-reporting is treated far more leniently than under-reporting.

Examples: Reportable vs Non-Reportable Breaches

The table below shows how typical incidents are usually categorised. Each case still requires its own risk assessment.

Incident	Usually Reportable?	Reason
Ransomware encrypting customer database	Yes	Loss of availability and potential exfiltration
Email with 200 clients BCC'd correctly, no data exposed	No	No breach occurred
Email with 200 clients CC'd instead of BCC	Usually yes	Unauthorised disclosure of email addresses
Lost encrypted laptop with strong password	Often no	Data unintelligible to unauthorised persons
Lost unencrypted USB with HR records	Yes	High risk to rights and freedoms
Payroll file emailed to wrong internal manager	Case by case	Depends on data and recipient's role
Phishing attack giving access to a single mailbox	Usually yes	Mailboxes typically contain personal data

How to Report a Data Breach to the ICO: Step by Step

The ICO offers several reporting channels depending on the nature of the breach. For most organisations handling a standard personal data breach under UK GDPR, follow these steps.

Step 1: Contain the Breach

Before reporting, take immediate steps to limit the damage. This might mean revoking account access, isolating infected systems, recalling misdirected emails, or changing passwords. Document every containment action with timestamps — the ICO will ask.

Step 2: Investigate and Document

Gather the facts before you fill in the form. You will need:

• Date and time the breach occurred and was discovered
• Description of the incident and how it happened
• Categories and approximate numbers of data subjects affected
• Categories and approximate numbers of records affected
• Likely consequences for individuals
• Measures taken or proposed to address the breach
• Contact details of your Data Protection Officer (DPO) or responsible person

Step 3: Choose the Correct Reporting Channel

The ICO provides different routes for different types of incident:

• Personal data breach (UK GDPR) — use the online self-assessment and report form on ico.org.uk, or call the breach helpline on 0303 123 1113 (option 3) during working hours.
• Communications service providers (PECR) — telecoms and internet service providers must use the dedicated PECR breach form within 24 hours.
• Trust service providers (eIDAS) — separate notification route applies.
• NIS Regulations incidents — operators of essential services and relevant digital service providers use the NIS reporting form.

Outside working hours, use the online form rather than waiting — it is time-stamped and preserves your 72-hour compliance record.

Step 4: Complete the ICO Online Form

The online form takes about 20 to 40 minutes if you have your facts ready. It covers:

1. Your organisation's details and registration number
2. The nature of the breach (confidentiality, integrity, availability)
3. Categories of personal data involved
4. Numbers of individuals and records affected
5. Potential consequences
6. Mitigation and remediation measures
7. Whether and how you have notified affected individuals

If you do not have all the information within 72 hours, submit what you have and clearly flag it as a phased notification. You can update the ICO as your investigation progresses.

Step 5: Notify Affected Individuals (If Required)

Where the breach is likely to result in a high risk to individuals, you must also tell them directly without undue delay. The notification must be in clear, plain English and include:

• A description of the breach
• The name and contact details of your DPO or contact point
• The likely consequences
• The measures you have taken or propose to take
• Practical advice on what the individual can do to protect themselves

Step 6: Record Everything in Your Breach Log

Article 33(5) of the UK GDPR requires you to document all breaches — reportable or not — in an internal breach register. The ICO can ask to see this at any time.

What Happens After You Report?

Once your report is submitted, the ICO's case triage team reviews it, usually within a few working days. Possible outcomes include:

• No further action — the most common outcome where mitigation looks reasonable.
• Request for further information — the ICO asks follow-up questions.
• Investigation — opened where there are signs of systemic failures, large-scale impact, or special category data.
• Regulatory action — reprimands, enforcement notices, or monetary penalties under section 155 of the Data Protection Act 2018.

Cooperating fully, demonstrating genuine remediation, and showing you have learned from the incident significantly reduce the chance of enforcement.

Penalties for Failing to Report

Failing to notify a reportable breach is itself a breach of UK GDPR Article 33. The ICO can issue fines of up to £8.7 million or 2% of global annual turnover, whichever is higher, specifically for notification failures. Separately, the underlying breach can attract fines of up to £17.5 million or 4% of global turnover.

Recent ICO enforcement patterns show that delayed reporting, poor record-keeping and weak basic security controls are the biggest aggravating factors.

Common Mistakes When Reporting to the ICO

Based on published ICO decisions and reprimands, these are the mistakes to avoid:

1. Starting the 72-hour clock too late — some organisations wait until investigation is complete before accepting "awareness". The ICO expects awareness to be recognised promptly.
2. Under-reporting the number of affected individuals — always provide ranges if exact figures are unknown.
3. Vague mitigation descriptions — "we are reviewing our processes" is not enough. Be specific.
4. Not notifying individuals when risk is high — the ICO can order you to do so, which is far worse than doing it voluntarily.
5. No breach log — unable to demonstrate accountability under Article 5(2).
6. Sharing sensitive links insecurely during the response — when sending evidence or incident bulletins, use a trusted link management tool such as Lunyb so you can track access, expire links, and avoid exposing raw file paths.

Preparing Before a Breach Happens

The best time to prepare for ICO reporting is before you need to. A short, rehearsed incident response plan beats a 500-page policy every time.

Build a Breach Response Playbook

Your playbook should cover roles, escalation paths, template communications, and a decision tree for the notifiability assessment. Run a tabletop exercise at least once a year.

Technical Controls That Reduce Reportability

Strong encryption, pseudonymisation, multi-factor authentication, DNS filtering and least-privilege access can all reduce the likelihood that an incident becomes a notifiable breach. For example, a lost device with full-disk encryption and no cached credentials may fall outside the reporting threshold entirely.

For teams that regularly share sensitive URLs — audit evidence, HR documents, customer portals — using controlled, expiring short links with analytics (such as those offered by Lunyb) is a simple way to reduce accidental disclosure risk. If link management is new to your organisation, our 2026 buyer's guide to URL shorteners compares the main options.

Train Your People

The majority of ICO-reported breaches still involve human error — misdirected emails, lost devices, phishing. Short, frequent training beats annual compliance modules. Every staff member should know who to contact within the first hour of discovering an incident.

Special Cases

Processors Reporting to Controllers

If you are a processor (for example, a SaaS vendor), you do not report to the ICO directly. Under Article 33(2), you must notify the controller "without undue delay" after becoming aware of the breach. Your contract should specify exact timelines — commonly 24 to 48 hours.

Cross-Border Breaches

If your organisation operates across the UK and EU, you may need to notify both the ICO and an EU lead supervisory authority. The ICO is no longer part of the EU one-stop-shop mechanism post-Brexit, so dual reporting is often required.

Breaches at Suppliers

You remain accountable as the controller when a processor suffers a breach affecting your data. Make sure contracts give you the information you need to meet the 72-hour deadline — including a direct notification channel and support with the risk assessment.

Frequently Asked Questions

How long do I have to report a data breach to the ICO?

You have 72 hours from the moment you become aware of a notifiable personal data breach. If you report later, you must explain the delay. The clock runs continuously, including weekends and bank holidays, so use the online form outside working hours.

Do I have to report every data breach to the ICO?

No. You only need to report breaches that are likely to result in a risk to the rights and freedoms of individuals. However, you must record every breach — reportable or not — in an internal log under Article 33(5) of the UK GDPR.

What happens if I report a breach late?

Late reporting is itself a breach of UK GDPR. The ICO will consider the reasons for the delay, whether you cooperated once you did report, and the steps taken to prevent recurrence. Late reporting is a common aggravating factor in enforcement decisions, but transparent, well-explained delays are treated more sympathetically than concealment.

Can I report a breach anonymously?

Organisations cannot report anonymously — the ICO needs to know who is accountable. If you are an individual whose data has been compromised, or a whistleblower reporting an organisation's failure, you can contact the ICO's helpline for guidance on complaints rather than breach notifications.

Will the ICO always fine my organisation after a breach report?

No. The majority of reported breaches result in no formal action beyond advice. Fines are reserved for serious or systemic failures, particularly where organisations ignored known risks, failed to notify, or had inadequate basic security. Prompt reporting, clear remediation, and strong accountability documentation substantially reduce the risk of enforcement.

What is the difference between reporting under UK GDPR and PECR?

UK GDPR applies to all controllers and gives you 72 hours. The Privacy and Electronic Communications Regulations (PECR) apply specifically to public electronic communications service providers and require notification within 24 hours using a different form. Some incidents may trigger both regimes.