How to Report a Data Breach to the ICO: A UK Step-by-Step Guide

If your personal data has been exposed — or if you run a small business or side project that just suffered a leak — reporting the breach to the Information Commissioner's Office (ICO) is often not optional. The UK GDPR gives organisations a tight 72-hour window to notify the ICO after becoming aware of a qualifying breach, and individuals have the right to raise complaints too.

At Lunyb, we deal with the aftermath of leaks every day. Our Data Breach Alerts flag when your email or phone number turns up in a known exposure, our Scam Checker helps you spot the phishing that always follows a breach, and our Password Vault lets you rotate credentials in minutes instead of hours. This guide walks you through the ICO reporting process step by step — and shows you exactly how to tidy up your own exposure while you do it.

When you must report a data breach to the ICO

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Not every breach needs to be reported — but a lot more do than people assume.

The 72-hour rule

Under UK GDPR, if you are a data controller and a breach is likely to result in a risk to people's rights and freedoms, you must notify the ICO without undue delay and, where feasible, no later than 72 hours after becoming aware of it. The clock starts when you become aware the breach has probably happened, not when you have all the details.

When reporting is not required

• The breach is unlikely to result in any risk to individuals (for example, a properly encrypted laptop lost with no usable data).
• The incident does not involve personal data at all.
• You are a data processor — in that case you must notify the controller, who then decides on ICO reporting.

When you must also tell the people affected

If the breach is likely to result in a high risk to individuals — think leaked passwords, financial details, health data, or information that enables identity fraud — you must notify those people directly, in clear and plain language, without undue delay.

How to report a data breach to the ICO: the step-by-step process

Reporting a breach to the ICO is done through their online self-reporting tool, by phone, or in writing. Here is the practical order of operations.

1. Contain the breach. Stop the bleeding first. Revoke access, change passwords, isolate affected systems, recall misdirected emails if possible.
2. Assess what happened. Identify the type of data, the number of individuals affected, the likely consequences, and whether the data was encrypted.
3. Decide if it is reportable. Apply the "risk to rights and freedoms" test. When in doubt, the ICO recommends reporting.
4. Gather your information. Nature of the breach, categories and approximate number of individuals and records concerned, likely consequences, and measures taken or proposed.
5. Submit to the ICO within 72 hours. Use the ICO's personal data breach reporting tool on ico.org.uk, or call their breach helpline on 0303 123 1113.
6. Notify affected individuals if the risk is high. Explain what happened, what data was involved, what you are doing about it, and what they should do (change passwords, watch for scams, check statements).
7. Document everything. Even if you decide a breach is not reportable, you must keep an internal record of the facts, effects, and remedial action taken.
8. Follow up with the ICO. If you did not have all the details at first submission, you can and should send updates as the investigation progresses.

What information the ICO will ask for

The ICO's online form is structured, so it helps to prepare answers before you start. Expect to supply:

• Your organisation's name and ICO registration number (if you have one).
• Contact details for the data protection officer or lead responder.
• Date and time the breach happened and when you became aware.
• A description of the incident and how it was discovered.
• Categories of personal data involved (contact details, financial, special category, etc.).
• Approximate numbers of data subjects and records affected.
• Likely consequences for individuals.
• Measures taken to contain the breach and prevent recurrence.
• Whether and how you have communicated with affected individuals.

Reporting a breach as an individual (not a business)

If your data has been leaked by a company and they have not handled it properly, you have rights too. You cannot technically "report a breach to the ICO" as a victim in the same way a controller does — but you can raise a complaint.

How to raise a complaint with the ICO

1. Complain to the organisation first. Contact their data protection officer or customer service in writing and give them a chance to respond (normally one month).
2. Keep evidence. Save the breach notification email, any screenshots, correspondence, and dates.
3. Submit a complaint on ico.org.uk. Use the "Make a complaint" section. Explain what happened, what the organisation said, and what harm you have suffered or fear.
4. Wait for the ICO's response. They may contact the organisation, issue guidance, or in serious cases open a formal investigation.

What the ICO can and cannot do for you

The ICO can investigate, reprimand, fine, and order changes. It cannot award you compensation directly — for that you would need to pursue the organisation through the courts or a legal representative. But an ICO decision in your favour strengthens any later claim.

Protect yourself after a breach — this is where Lunyb comes in

Reporting the breach is only half the job. The other half is making sure your accounts, inbox, and phone don't become the attacker's next playground. This is exactly what Lunyb is built for, and it is the fastest way for a UK consumer to lock things down after an incident.

Data Breach Alerts — know the moment you're exposed

Lunyb scans known breach databases for your email address and phone number and tells you which leaks you appear in, what data was exposed, and what to change. Instead of waiting for a company's press release — which often arrives weeks late — you get a clear, actionable list the moment a match is found.

Scam Checker and Scam Shield — survive the phishing wave

Every major UK breach is followed by a surge in phishing texts, fake "delivery" scams, and spoofed bank calls targeting the leaked numbers and emails. Lunyb's Scam Checker lets you paste any suspicious message or link to get a verdict in seconds, and Scam Shield helps block known nuisance and fraud callers before they reach you.

Password & Photo Vault — rotate credentials in minutes

After a breach, the single most important action is changing reused passwords. Our encrypted Password Vault stores and generates strong, unique logins so you can rotate the risky ones quickly — and the Photo Vault keeps sensitive documents (like ID scans you may need for an ICO complaint) encrypted on your device.

Privacy Check and Security Score — close the gaps that caused it

Our Privacy Check reviews app permissions on your phone — microphone, location, contacts, background data — and our Security Score summarises your overall risk with a prioritised to-do list. On-device tracker and threat blocking (via a local DNS shield, not a tunnelling service) stops many malicious domains from loading in the first place.

Optional Leak Protection

For people who want ongoing help getting their details off data-broker sites and reducing future exposure, Lunyb offers an optional Leak Protection add-on. It is billed separately and can be paused without cancelling your main plan — pricing starts at around £19.99/month for the core app, and you can cancel anytime online.

A practical breach-response checklist for UK consumers

Use this list the moment you learn your data has been caught in a breach — whether you were notified directly or saw it in the news.

Step	What to do	How Lunyb helps
1. Confirm exposure	Check whether your email/phone is in the breach.	Data Breach Alerts show matches and exposed data types.
2. Change the affected password	Start with the breached service, then any reused logins.	Password Vault generates and stores strong unique passwords.
3. Turn on two-factor authentication	Prioritise email, banking, and cloud storage.	Security Score flags accounts without 2FA.
4. Watch for phishing	Expect fake "security" emails, texts, and calls.	Scam Checker and Scam Shield screen messages and callers.
5. Review bank and card statements	Flag anything you don't recognise within hours, not weeks.	—
6. Complain to the organisation	Ask what happened and what they are doing about it.	Photo Vault stores evidence securely.
7. Complain to the ICO if needed	Use ico.org.uk if the organisation's response is inadequate.	—
8. Reduce future exposure	Lock down app permissions and data-broker listings.	Privacy Check + optional Leak Protection.

Common mistakes that make breaches worse

Waiting too long to notify

The 72-hour window is tight. Organisations that delay often face harsher ICO scrutiny than those that report promptly with incomplete information and follow up later.

Only changing the breached password

If you reused that password anywhere else, every reused account is now exposed. Rotate them all — a password manager turns this from a weekend chore into a ten-minute task.

Ignoring the phishing surge

Attackers buy breach dumps within days. The call from "your bank's fraud team" asking you to move money to a "safe account" is textbook — and it works. Verify every unexpected contact independently.

Assuming the ICO will contact you

If you are an affected individual and the organisation never notified you, the ICO is unlikely to reach out personally. You need to raise the complaint yourself.

Start protecting yourself now

Reporting a breach to the ICO — whether as a business meeting its 72-hour duty or as an individual filing a complaint — is a necessary step. But the real protection happens in what you do next: rotating passwords, watching for scams, and shrinking the data footprint that made you a target in the first place.

That's what Lunyb is built for. Head to lunyb.com, take the free privacy quiz to see where you stand, and download the app to run your first Data Breach Alert scan in minutes. If you want to see how we think about trust and transparency, our team's write-up on whether Lunyb is legit covers the basics, and our Rebrandly comparison explains the link-shortening side of what we do.

Frequently asked questions

How long do I have to report a data breach to the ICO?

If you are a data controller and the breach is likely to risk individuals' rights and freedoms, you must notify the ICO without undue delay and no later than 72 hours after becoming aware of it. If you need more time to gather details, submit what you have and update the ICO later.

Can I report a data breach to the ICO as a member of the public?

You can raise a complaint with the ICO if an organisation has mishandled your personal data or failed to tell you about a breach. Try to resolve it with the organisation first, keep evidence, then submit a complaint on ico.org.uk.

What happens if a business fails to report a breach?

The ICO can issue reprimands, enforcement notices, and significant fines under UK GDPR, especially for serious or repeated failures. Late or missing notifications typically make the outcome worse, so prompt reporting is always the safer route.

How do I know if my data has been leaked?

You might receive a notification from the breached organisation, see news coverage, or notice suspicious activity. Lunyb's Data Breach Alerts actively check your email and phone number against known exposures and tell you what to do next.

What should I do immediately after my data is leaked?

Change the password on the breached account and any account that reused it, enable two-factor authentication, watch for phishing texts and calls, monitor your bank statements, and consider ongoing protection like Lunyb to catch future leaks early.