How to Report a Data Breach to the ICO: UK Guide 2026

Discovering a personal data breach is one of the most stressful moments for any UK organisation. Under the UK GDPR and the Data Protection Act 2018, you may have just 72 hours to notify the Information Commissioner's Office (ICO) — and getting that notification wrong can lead to fines, reputational damage, and regulatory scrutiny. This guide walks you through exactly how to report a data breach to the ICO, when you must do so, what information to include, and how to protect your organisation before, during, and after the incident.

What Counts as a Personal Data Breach?

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It is not limited to cyberattacks — human error is a far more common cause.

Under Article 4(12) of the UK GDPR, breaches fall into three broad categories:

Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data (e.g. sending an email to the wrong recipient).
Integrity breach — unauthorised or accidental alteration of personal data.
Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data (e.g. ransomware that encrypts customer records).

Common Examples of Reportable Breaches

A lost or stolen laptop containing unencrypted customer details.
An employee emailing a spreadsheet of staff salaries to the wrong internal group.
A phishing attack resulting in a mailbox being compromised.
A ransomware infection that encrypts a payroll database.
A misconfigured cloud storage bucket exposing client files to the public internet.

Do You Actually Need to Report It to the ICO?

Not every breach must be reported. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. If the risk is unlikely to materialise, you do not need to report — but you must still document the incident internally.

Risk Assessment Checklist

Ask the following questions to determine the level of risk:

What type of data is involved? Special category data (health, biometric, political views) or financial data increases risk significantly.
How many individuals are affected? Larger numbers generally raise the risk profile, though even one person's data can trigger a notification duty if the impact is severe.
Could individuals suffer physical, material, or non-material harm? This includes identity theft, fraud, financial loss, discrimination, or reputational damage.
Was the data encrypted or pseudonymised? Strong encryption often reduces risk because the data remains unintelligible to the attacker.
Can the breach be contained? If the data has already been recovered or securely deleted, risk may be reduced.

When You Must Also Tell the Affected Individuals

If the breach is likely to result in a high risk to individuals, you must also notify those individuals directly — not just the ICO — without undue delay. The communication must be in clear, plain language and explain what happened, the likely consequences, and the steps being taken.

The 72-Hour Reporting Deadline Explained

The clock starts when your organisation becomes aware of the breach — not when it occurred. Awareness means having a reasonable degree of certainty that a security incident has led to personal data being compromised.

You have 72 hours from that point to notify the ICO. If you miss the deadline, you can still report — but you must provide reasons for the delay. Failure to notify when required can itself result in a fine of up to £8.7 million or 2% of global annual turnover, whichever is higher.

Phased Reporting Is Allowed

If you don't have all the facts within 72 hours, you can submit an initial report and follow up with additional information as your investigation progresses. The ICO prefers a timely partial report over a late complete one.

Step-by-Step: How to Report a Data Breach to the ICO

Follow this structured process to ensure your notification is compliant and effective.

Step 1: Contain and Assess the Breach

Before you report, take immediate steps to limit the damage. Disconnect affected systems, revoke compromised credentials, isolate infected devices, and preserve evidence for forensic investigation. Begin documenting everything in a breach log — timestamps, actions taken, and people involved.

Step 2: Convene Your Incident Response Team

Bring together your Data Protection Officer (DPO), IT/security lead, legal counsel, and a senior decision-maker. Smaller organisations should have a named responsible person identified in advance. This team will decide whether the ICO threshold is met.

Step 3: Gather the Required Information

The ICO's online report form will ask for:

The nature of the breach (confidentiality, integrity, availability).
Categories and approximate number of individuals affected.
Categories and approximate number of personal data records concerned.
Likely consequences of the breach.
Measures taken or proposed to address the breach and mitigate harm.
Contact details of your DPO or main point of contact.

Step 4: Submit via the ICO's Online Service

Go to the ICO website (ico.org.uk) and use the Personal Data Breach reporting service. You can submit the report online 24/7. For urgent reports outside business hours, the ICO also provides a helpline on 0303 123 1113.

Step 5: Notify Affected Individuals (If Required)

If the risk is high, send clear communications to those affected. Include what data was involved, what you are doing about it, and practical steps individuals can take (such as changing passwords or monitoring bank statements).

Step 6: Document Everything

Even if you decide not to report, you must keep an internal record of all personal data breaches, including the facts, effects, and remedial action taken. The ICO can request this log at any time during an audit.

Step 7: Follow Up and Review

After the initial response, conduct a post-incident review. Update policies, deliver refresher training, and patch the vulnerabilities that led to the breach. The ICO looks favourably on organisations that demonstrate lessons learned.

What Information the ICO Form Requires

Here is a summary of the key sections you'll encounter in the ICO's online breach report:

Section	What to Include
Your organisation	Name, ICO registration number, sector, size
Contact details	DPO or responsible person, phone, email
Breach details	When it happened, when discovered, how it was discovered
Data involved	Types of personal data, special category data, volume
People affected	Categories (customers, staff, children, etc.) and approximate numbers
Impact	Potential and actual consequences for individuals
Remediation	Containment steps, mitigation, communications sent
Preventive measures	What you'll do to prevent recurrence

Common Mistakes to Avoid

Waiting too long to decide. Even if you're unsure whether to report, start the 72-hour clock from the moment of awareness.
Over-reporting trivial incidents. If there is no realistic risk to individuals, document it internally but don't flood the ICO with unnecessary notifications.
Under-estimating the scope. A compromised mailbox may contain years of correspondence; review the data properly before quantifying impact.
Forgetting to tell the individuals. Reporting only to the ICO when the risk is high leaves you non-compliant.
No written breach log. The absence of documentation is itself a compliance failure.

How Processors Should Report Breaches

If you are a data processor (not the controller), your obligation is different. You must notify the controller without undue delay after becoming aware of a breach. The controller then decides whether to report to the ICO. Make sure your processor contracts clearly set out notification timelines, typically within 24 hours.

Preventing Breaches Before They Happen

The best breach report is the one you never need to send. A defence-in-depth approach combines people, process, and technology.

Technical Controls

Enforce multi-factor authentication on all accounts, especially email and admin consoles.
Encrypt data at rest and in transit, including laptops, USB drives, and backups.
Use encrypted DNS and reputable email filtering to block phishing at the gateway.
Patch systems promptly and remove software that is no longer supported.
Segment networks so a single compromise cannot reach your entire estate.

Organisational Controls

Deliver annual data protection training, with targeted sessions for high-risk roles.
Maintain an up-to-date Record of Processing Activities (ROPA).
Run simulated phishing exercises and breach tabletop drills.
Appoint a DPO (or equivalent) with clear reporting lines to senior management.

Watch Your Links and Shared Content

Many breaches start with a malicious or spoofed link. When sharing URLs externally — in marketing campaigns, internal comms, or customer communications — use a trusted link management platform that provides analytics, expiry controls, and safe redirects. Services like Lunyb allow you to shorten and manage links with built-in tracking so you can spot unusual activity quickly. If you're comparing options, our 2026 buyer's guide to URL shorteners and our honest Lunyb review are good starting points.

After the Report: What to Expect from the ICO

Once your report is submitted, the ICO will acknowledge receipt and may follow up with questions. Possible outcomes include:

No further action — the ICO is satisfied with your response.
Advice and guidance — informal recommendations to improve practices.
Formal investigation — for serious or repeat breaches.
Enforcement action — reprimands, enforcement notices, or monetary penalties.

Being transparent, cooperative, and demonstrating genuine improvement makes a significant difference to the final outcome.

FAQ

How long do I have to report a data breach to the ICO?

You must report a notifiable personal data breach to the ICO within 72 hours of becoming aware of it. If you miss the deadline, you can still report but must explain the reason for the delay.

Do I have to report every breach?

No. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. However, you must keep an internal record of all breaches, whether reported or not.

What happens if I don't report a breach that I should have?

Failure to notify the ICO when required can result in a fine of up to £8.7 million or 2% of global annual turnover, whichever is higher. It also damages your organisation's credibility during any future investigation.

Can I report a breach outside normal working hours?

Yes. The ICO's online breach reporting service is available 24/7, and there is also a helpline (0303 123 1113) for urgent incidents. The 72-hour clock does not pause for weekends or bank holidays.

What if the breach happened at one of my suppliers?

If a processor acting on your behalf suffers a breach, they must notify you without undue delay. As the controller, you remain responsible for deciding whether to report to the ICO and for notifying any affected individuals.