How to Report a Data Breach to the ICO: A Complete UK Guide (2026)

If your organisation has suffered a personal data breach, you may be legally required to notify the Information Commissioner's Office (ICO) within 72 hours. Failing to do so correctly can result in significant fines under the UK GDPR. This guide explains exactly when, how and what to report, with practical steps you can follow immediately.

What Is a Personal Data Breach Under UK GDPR?

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is not limited to cyberattacks — human error, lost devices and misdirected emails all count.

Under Article 4(12) of the UK GDPR, breaches fall into three broad categories:

• Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
• Integrity breach — unauthorised or accidental alteration of personal data.
• Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data.

Common Examples of Reportable Breaches

• A ransomware attack encrypting a customer database.
• An employee emailing a spreadsheet of client details to the wrong recipient.
• A stolen or lost unencrypted laptop containing staff records.
• Misconfigured cloud storage exposing personal files to the public internet.
• Phishing attacks resulting in compromised login credentials.

When Must You Report a Data Breach to the ICO?

You must report a notifiable breach to the ICO without undue delay and within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. The 72-hour clock starts when you have a reasonable degree of certainty that a breach has occurred — not when you first suspect it.

The Risk Threshold Test

Not every breach is reportable. The question is whether it is likely to result in a risk to people's rights and freedoms. Consider:

1. Type of breach — confidentiality breaches often carry higher risk than availability ones.
2. Nature and volume of data — special category data (health, biometrics, religion) escalates risk.
3. Ease of identifying individuals — pseudonymised data may lower risk.
4. Severity of consequences — financial loss, identity theft, reputational damage or discrimination.
5. Number of affected individuals.
6. Vulnerability of those affected — children, patients or at-risk adults.

If in doubt, the ICO advises you to report. Under-reporting is treated more seriously than reasonable over-reporting.

Step-by-Step: How to Report a Data Breach to the ICO

Reporting involves three stages: internal assessment, ICO notification, and (where required) communication with affected individuals. Here is the full process.

Step 1: Contain and Assess the Breach

1. Activate your incident response plan and isolate affected systems.
2. Identify what data was involved, how many people are affected and the potential consequences.
3. Document every decision and timestamp — the ICO will want an audit trail.
4. Engage your Data Protection Officer (DPO), legal counsel and IT/security teams.

Step 2: Decide Whether the Breach Is Notifiable

Apply the risk threshold test above. If the breach is unlikely to result in risk, you do not need to notify — but you must still record it internally in your breach register under Article 33(5).

Step 3: Notify the ICO Within 72 Hours

The ICO provides two main reporting channels:

• Online reporting form — the preferred method, available at ico.org.uk under "Report a breach". This is the fastest and most structured route.
• Breach helpline — call 0303 123 1113 (open Monday to Friday, 9am-5pm). Useful for urgent or complex cases outside normal reporting categories.

If you cannot provide full details within 72 hours, submit an initial report explaining what you know and flag it as "in phases". You can then supply further information as your investigation progresses.

Step 4: Notify Affected Individuals (If Required)

Where the breach is likely to result in a high risk to individuals, you must also inform them directly, without undue delay. The notification must be in clear, plain language and include:

• A description of the breach.
• Name and contact details of your DPO or breach contact.
• Likely consequences of the breach.
• Measures taken or proposed to address it and mitigate harm.

Step 5: Document Everything

Regardless of whether a breach is reported, Article 33(5) requires you to maintain an internal record of all personal data breaches, including facts, effects and remedial action. The ICO can request this at any time.

What Information Does the ICO Need?

When you submit a report, be ready to provide the following details. Preparing a template in advance will save critical time during an incident.

Category	Information Required
Organisation details	Name, ICO registration number, sector, DPO contact
Breach description	What happened, when it was discovered, cause
Data involved	Categories (name, email, financial, health etc.), approximate volume
People affected	Number and categories (customers, staff, children, vulnerable adults)
Consequences	Likely impact, severity, risk level
Containment measures	Steps taken to stop the breach and reduce harm
Communications	Whether individuals have been informed and how

Penalties for Failing to Report a Data Breach

Non-compliance with breach notification rules is treated as a standalone infringement under the UK GDPR, separate from the breach itself.

Maximum Fines

• Standard maximum — up to £8.7 million or 2% of global annual turnover, whichever is higher. This applies to notification failures.
• Higher maximum — up to £17.5 million or 4% of global turnover for breaches of core data protection principles.

Real-World Examples

The ICO has fined organisations millions for delayed or inadequate reporting. In some cases, the fine for failing to properly notify or protect data has exceeded the operational cost of the original incident many times over. Beyond fines, enforcement notices, audits and reputational damage can be equally damaging.

Reducing Your Risk Before a Breach Happens

The best breach response is prevention. Strong data hygiene reduces both the likelihood of an incident and the scope of any that occur.

Technical Measures

• Encrypt data at rest and in transit, including laptops, backups and removable media.
• Enforce multi-factor authentication on all accounts handling personal data.
• Patch systems promptly and run regular vulnerability scans.
• Use secure, privacy-respecting tools for sharing links and files. For example, when distributing campaign or internal URLs, a privacy-first shortener like Lunyb avoids embedding tracking parameters that could themselves become personal data liabilities.
• Implement endpoint detection and response (EDR) across the estate.

Organisational Measures

• Appoint a DPO or designated breach lead.
• Maintain an up-to-date Record of Processing Activities (ROPA).
• Deliver regular staff training on phishing, data handling and incident reporting.
• Test your incident response plan with tabletop exercises at least annually.
• Review third-party processor contracts for breach notification obligations.

Common Mistakes When Reporting to the ICO

Even well-prepared organisations trip over avoidable errors during a live incident. Watch out for these pitfalls.

1. Missing the 72-hour deadline because the clock was started too late. Awareness means reasonable certainty, not full forensic confirmation.
2. Waiting until you "know everything" — the ICO expects phased reporting, not a perfect submission on day one.
3. Underestimating risk and failing to inform affected individuals when required.
4. Poor documentation — undated notes and verbal decisions won't satisfy an audit.
5. Ignoring near misses — these should still be logged in the internal breach register.
6. Over-communicating prematurely to the public before facts are confirmed, which can increase harm.

Reporting Breaches Involving Third Parties and Processors

If a data processor (for example, a cloud vendor or payroll provider) suffers a breach involving your data, they must notify you without undue delay. As the controller, you are then responsible for assessing and reporting to the ICO — the processor does not report on your behalf.

Make sure your data processing agreements (DPAs) clearly specify:

• Notification timeframes (ideally within 24 hours of discovery).
• Minimum information the processor must provide.
• Cooperation obligations during investigation.
• Indemnities where appropriate.

After the Report: What to Expect from the ICO

Once your report is submitted, the ICO will acknowledge receipt and may:

1. Request further information or clarification.
2. Take no further action if the response and controls are deemed adequate.
3. Issue informal advice or warnings.
4. Open a formal investigation, which can lead to enforcement notices or monetary penalties.

Cooperate fully, be transparent and demonstrate the remedial actions you've taken. A well-handled response — even to a serious breach — can significantly reduce regulatory consequences.

Related Reading

For more on choosing privacy-respecting tools that reduce your data footprint, see our review of Lunyb as a privacy-first URL shortener and our comparison Rebrandly Review 2026.

Frequently Asked Questions

Do I need to report every data breach to the ICO?

No. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. However, you must record every breach internally, including those you decide not to report, and justify the decision in writing.

What happens if I miss the 72-hour deadline?

You should still report the breach, but include a clear explanation of the delay as required by Article 33(1). Missing the deadline without justification can lead to additional regulatory scrutiny and potential fines of up to £8.7 million or 2% of global turnover.

Can I report a breach anonymously as an individual?

Yes. If you are an employee, customer or member of the public concerned about how an organisation has handled your personal data, you can raise a complaint with the ICO directly via their website. This is separate from the formal controller breach notification process.

Does the 72-hour clock include weekends and bank holidays?

Yes. The 72-hour period runs continuously from the moment of awareness, including weekends and holidays. This is why having an out-of-hours incident response capability is essential for any organisation processing significant volumes of personal data.

What is the difference between a data breach and a near miss?

A data breach involves actual unauthorised access, loss, alteration or disclosure of personal data. A near miss is an incident that could have resulted in a breach but was prevented — for example, a phishing email that was identified and blocked before anyone clicked. Near misses do not need to be reported to the ICO but should be logged internally to inform future risk management.