How to Report a Data Breach to the ICO: A Complete UK Guide (2026)

If your organisation has suffered a personal data breach, you may be legally required to notify the Information Commissioner's Office (ICO) within 72 hours. Failing to do so can result in significant fines under the UK GDPR and the Data Protection Act 2018. This guide walks you through exactly how to report a data breach to the ICO, what information you'll need, and how to avoid common mistakes that trip up data controllers.

What Is a Personal Data Breach Under UK GDPR?

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Under Article 4(12) of the UK GDPR, a breach isn't just a hack — it includes lost laptops, misdirected emails, ransomware attacks, and even verbal disclosures to the wrong party.

The ICO recognises three broad categories of breach:

Confidentiality breach — unauthorised or accidental disclosure of, or access to, personal data.
Integrity breach — unauthorised or accidental alteration of personal data.
Availability breach — accidental or unauthorised loss of access to, or destruction of, personal data.

Common Examples of Reportable Breaches

A phishing attack that compromises customer email addresses and passwords.
An employee emailing a spreadsheet of client records to the wrong recipient.
A stolen or lost unencrypted USB drive, laptop, or mobile phone containing personal data.
Ransomware encrypting your customer database with no viable backup.
A misconfigured cloud bucket exposing user records to the public internet.

Do You Actually Need to Report the Breach?

Not every data breach must be reported to the ICO. The legal test under Article 33 of the UK GDPR is whether the breach is "likely to result in a risk to the rights and freedoms of natural persons." If there's no risk, you can simply record the incident internally. If there is a risk, you must notify the ICO. If the risk is high, you must also notify the affected individuals directly.

Risk Assessment Checklist

When assessing risk, consider:

Type of breach — confidentiality breaches of sensitive data are usually higher risk.
Nature and volume of data — does it include special category data (health, biometrics, ethnicity) or financial details?
Ease of identification — can individuals be identified directly or indirectly from the exposed data?
Severity of consequences — could the breach lead to identity theft, fraud, discrimination, or reputational damage?
Number of individuals affected — larger scale usually increases risk.
Special characteristics — are children or vulnerable adults involved?

Reporting Thresholds at a Glance

Risk Level	Notify ICO?	Notify Individuals?	Timeframe
No risk	No (record internally)	No	N/A
Risk to rights and freedoms	Yes	No (optional)	Within 72 hours
High risk to rights and freedoms	Yes	Yes	Without undue delay

The 72-Hour Rule: When the Clock Starts

You must report a notifiable breach to the ICO within 72 hours of becoming aware of it. "Awareness" means having a reasonable degree of certainty that a security incident has occurred that led to personal data being compromised — not the moment you first suspect something is wrong.

The 72 hours includes weekends and bank holidays. If you miss the deadline, you can still report, but you must explain the reasons for the delay. The ICO takes late reports seriously, and unexplained delays can be treated as an aggravating factor when assessing penalties.

What If You Don't Have All the Information Yet?

The UK GDPR allows for phased reporting. If you don't have all the details within 72 hours, submit an initial report with what you know and clearly indicate that further information will follow. You can update the ICO as your investigation progresses.

How to Report a Data Breach to the ICO: Step-by-Step

Step 1: Contain the Breach

Before you report, take immediate steps to limit damage. Disconnect affected systems, revoke compromised credentials, isolate infected devices, and preserve evidence for forensic review. Document everything you do, including timestamps — this will form part of your report.

Step 2: Assess the Scope and Risk

Work with your Data Protection Officer (DPO), IT team, and legal counsel to understand:

What categories of personal data were affected.
How many data subjects are involved.
What the likely consequences are for those individuals.
What mitigating measures are already in place (e.g., encryption, access controls).

Step 3: Choose Your Reporting Method

The ICO offers several ways to report:

Online form — the fastest option, available at ico.org.uk. This is the preferred channel for most organisations.
Phone — call the ICO's breach helpline on 0303 123 1113 (open Monday to Friday, 9am to 5pm). Useful for urgent or complex cases.
Post — only recommended if other options aren't available, given the 72-hour window.

Step 4: Complete the Breach Notification Form

The ICO's online form will ask for:

Your organisation's name, sector, and ICO registration number.
Contact details for the person reporting (usually the DPO).
A description of the breach — what happened, when, and how it was discovered.
Categories and approximate number of data subjects affected.
Categories and approximate number of personal data records concerned.
Likely consequences of the breach.
Measures taken or proposed to address the breach and mitigate harm.
Whether affected individuals have been or will be notified.

Step 5: Keep a Breach Record

Regardless of whether you notify the ICO, Article 33(5) requires you to document all personal data breaches, including facts, effects, and remedial action. The ICO can request this log at any time.

Step 6: Notify Affected Individuals (If High Risk)

If the breach poses a high risk, communicate directly with those affected in clear, plain language. Tell them what happened, what data was involved, what you're doing about it, and what they can do to protect themselves (e.g., change passwords, monitor accounts).

What Happens After You Report?

The ICO will acknowledge your report and assign a case reference number. Depending on the severity, they may:

Take no further action beyond recording the breach.
Request additional information or clarification.
Launch a formal investigation.
Issue enforcement action, including reprimands, enforcement notices, or monetary penalties.

Under the UK GDPR, maximum fines are £17.5 million or 4% of annual global turnover, whichever is higher. However, the ICO generally reserves top-tier fines for the most serious cases involving systemic failures.

Common Mistakes When Reporting a Data Breach

1. Waiting Until You Have All the Facts

Many organisations miss the 72-hour deadline because they want a complete picture before reporting. The ICO expressly allows phased reporting — submit what you know and update later.

2. Underestimating the Risk

Some data controllers convince themselves that "no one will actually misuse this data." The risk test is objective and forward-looking. If there's a reasonable likelihood of harm, you must report.

3. Poor Internal Documentation

If you can't produce a breach log on request, the ICO may conclude that your accountability framework is inadequate — which is itself a UK GDPR violation.

4. Inconsistent Communication with Data Subjects

Sending vague or misleading notifications to affected individuals can erode trust and attract regulatory criticism. Be transparent, specific, and empathetic.

5. Failing to Learn from the Incident

Every breach should trigger a post-incident review. What technical, organisational, or training failures contributed? What changes will prevent recurrence? Document the lessons learned — regulators look favourably on organisations that demonstrate continuous improvement.

Reducing Breach Risk Before It Happens

The best breach report is the one you never have to file. Strong preventative controls reduce both the likelihood and impact of incidents:

Data minimisation — only collect and retain what you actually need.
Encryption at rest and in transit — significantly reduces risk even if data is exposed.
Role-based access controls — limit who can see sensitive records.
Multi-factor authentication — one of the single most effective controls against credential-based attacks.
Staff training — human error causes the majority of UK breaches. Regular awareness sessions matter.
Secure link sharing — avoid pasting sensitive URLs into public channels. Privacy-focused tools like Lunyb let you share shortened links with password protection and expiry controls, reducing the chance that an internal link ends up in the wrong hands. Read our honest Lunyb review for more detail.
Incident response plan — rehearsed playbooks mean your 72-hour clock doesn't catch you flat-footed.

Special Considerations for Specific Sectors

Healthcare and Social Care

NHS bodies and care providers handling special category health data face heightened scrutiny. Breaches involving medical records almost always meet the "high risk" threshold, triggering both ICO notification and individual communication.

Financial Services

FCA-regulated firms may also need to notify the Financial Conduct Authority separately, in addition to the ICO. Check your sectoral obligations.

Education

Schools and universities handling children's data must take extra care — the ICO treats breaches affecting minors as inherently higher risk.

Telecoms and ISPs

Providers of public electronic communications services have additional obligations under PECR, including a separate 24-hour notification deadline for certain breaches.

FAQ

What is the deadline to report a data breach to the ICO?

You must report a notifiable personal data breach to the ICO within 72 hours of becoming aware of it. This deadline includes weekends and bank holidays. If you can't provide all the information within 72 hours, you can submit a phased report and update the ICO as more details emerge.

What happens if I don't report a data breach within 72 hours?

Late reporting without a reasonable justification can itself be a UK GDPR infringement, resulting in fines of up to £8.7 million or 2% of global turnover. The ICO expects clear reasoning for any delay. Even if you're late, you should still report rather than not reporting at all.

Do I need to report every data breach to the ICO?

No. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. Minor incidents with no realistic chance of harm can be recorded internally without notification. However, you must document every breach in your internal log regardless.

Can I report a data breach anonymously as an individual?

If you're a member of the public reporting a breach by someone else (for example, your employer or a company that mishandled your data), you can raise a concern with the ICO. However, data controllers themselves cannot report anonymously — your organisation's details are required under Article 33.

How do I know if a breach is "high risk" and requires notifying individuals?

Consider the type of data involved (financial, health, or special category data increases risk), the potential consequences (identity theft, fraud, discrimination), the number and vulnerability of people affected, and whether any mitigating controls like encryption were in place. If serious harm is reasonably likely, notify affected individuals directly without undue delay.