If your organisation suffers a personal data breach, you may have to report it to the Information Commissioner’s Office (ICO) — and under UK GDPR Article 33 you must do so “without undue delay and, where feasible, not later than 72 hours after having become aware of it.” But here is the part people get wrong: you do not report every breach. You only report one that is “likely to result in a risk to the rights and freedoms of natural persons.” You do not call the police, you report to the ICO. And the 72 hours is clock time — it includes evenings, weekends and bank holidays, not just working hours. Even the breaches you decide not to report must still be written down in an internal log.
At a glance: Nexis CPD’s £9 Data Protection and GDPR Awareness course covers what a personal data breach is, how to assess the risk, the 72-hour rule and the ICO reporting process. It is CPD accredited and 100% online with a verifiable e-certificate, and any three courses cost £18. It is awareness training, not a regulated or legal qualification.
What counts as a personal data breach?
A personal data breach is far wider than a hacker breaking into a database, and this is the first thing most people underestimate. UK GDPR defines it as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.” Read that definition carefully: it covers three different kinds of failure. There is a confidentiality breach, where personal data is seen or taken by someone who should not have it. There is an integrity breach, where data is altered without authorisation. And there is an availability breach, where you lose access to the data or it is destroyed, even temporarily.
That means the following are all personal data breaches, even though several involve no criminal and no outsider at all:
- A laptop, phone or unencrypted USB stick containing personal data is lost or stolen.
- An email containing personal data is sent to the wrong recipient, or a “reply all” exposes everyone’s address.
- Paper files are left on a train, put in general recycling, or posted to the wrong address.
- Ransomware encrypts your systems so you cannot reach your own records — a loss of availability, and often of confidentiality too.
- A member of staff accesses records they have no business reason to look at.
- A supplier or cloud system you rely on is itself breached and your data is caught up in it.
The common thread is personal data: information about identifiable living people, from names and addresses to payroll, health and safeguarding records. A breach of purely commercial information with no personal data in it is a serious problem for your business, but it is not a “personal data breach” that engages the duties below. Losing a spreadsheet of staff bank details is; losing a spreadsheet of wholesale prices is not. Understanding what GDPR is and what it protects is the foundation for everything that follows.
Do you have to report every data breach to the ICO?
No — and this is the single most important point in the whole regime. The obligation to notify the ICO is set by Article 33 of the UK GDPR, which says a controller must notify the breach “unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.” Flip that double negative around and the test is clear: you report a breach if there is a risk to people, and you do not report it if any risk is unlikely.
“Risk to the rights and freedoms of natural persons” is not jargon for “we might get fined.” It means real-world harm to the people whose data it is: identity theft or fraud, financial loss, damage to reputation, discrimination, distress, or the exposure of something sensitive such as health, finances or someone’s home address. A misdirected email to a trusted colleague who deletes it immediately is low risk. The same email, listing clients’ names alongside a debt-recovery matter or a medical condition, sent to a stranger, is a very different matter.
Crucially, a decision not to report does not mean you can forget about the breach. Article 33(5) requires the controller to “document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.” In plain terms you must keep an internal breach log of every breach, including the ones you assess as low risk and choose not to report, together with your reasoning. That log is the evidence that you assessed the risk properly, and it is one of the first things the ICO will ask to see if a complaint is later made. If you are not sure whether a breach crosses the threshold, the ICO publishes a self-assessment tool to help you decide.
What is the 72-hour rule, exactly?
The 72-hour rule is the headline deadline, and it is routinely misread. Article 33 requires notification “without undue delay and, where feasible, not later than 72 hours after having become aware of it.” Three features of that wording matter.
First, the clock starts when you become aware of the breach, not when it happened and not when you finish investigating it. You are “aware” once you have a reasonable degree of certainty that a security incident has occurred that compromised personal data. A short period of investigation to establish that is acceptable, but you cannot stretch “awareness” out to buy time.
Second, the 72 hours is clock time, not working time. It runs continuously through evenings, weekends and bank holidays. A breach discovered at 5pm on the Friday of a bank-holiday weekend does not pause until Tuesday morning; the deadline is still roughly 72 hours later. This is why organisations need an out-of-hours plan, not just a nine-to-five one.
Third, the deadline is a backstop, not a target. The duty is to report “without undue delay” and within 72 hours, so if you can report sooner you should. The ICO’s own guidance encourages organisations to “report early, update later.” You are not expected to have every detail nailed down within 72 hours. Article 33(4) expressly allows information to be “provided in phases without undue further delay,” and if you cannot meet the deadline at all, the notification “shall be accompanied by reasons for the delay.” What you must not do is stay silent because the picture is incomplete.
How do you report a data breach to the ICO?
Reporting is done through the ICO, not the police (though genuine crimes such as theft or hacking may also warrant a separate report to the police or Report Fraud (formerly Action Fraud)). The ICO’s primary route is an online data breach reporting form. For high-risk breaches the ICO also operates a telephone helpline so you can report urgently; for lower-risk reportable breaches the online form is the normal channel.
A few practical points about the form itself, straight from the ICO’s guidance. It takes about 30 minutes to complete, and — importantly — you cannot save it and come back later, so gather your facts before you start. The ICO will ask you about:
- What has happened: the nature of the breach and the categories and approximate number of people and records affected.
- When and how you found out: the timeline, including when you became aware.
- Who has been or may be affected, and the likely consequences for them.
- What you are doing about it: the steps taken to contain the breach and to mitigate harm.
- Who to contact, usually your data protection officer or a named contact, and who else you have told.
Those categories mirror the minimum content Article 33(3) requires. You do not need a lawyer to complete the form, but you do need accurate facts, which is why the first hour after discovery matters so much. The ICO will send you a copy of what you submit and a reference, and you can add further detail later as your investigation develops.
What should you do in the first hour, 24 hours and 72 hours?
It helps to think of a breach response in three waves. None of this is a legal checklist in the statute, but it is the practical sequence that keeps you inside the Article 33 deadline.
In the first hour (contain and preserve). Stop the breach getting worse: recall the email if you can, disable the compromised account, isolate the affected system, or physically secure the area. Preserve evidence — do not wipe or “tidy up” logs and devices. Tell the person in your organisation who owns breach decisions, usually the data protection officer or a senior manager. Start a written timeline immediately, noting the moment you became aware, because that timestamp defines your 72-hour window.
In the first 24 hours (assess the risk). Establish what personal data was involved, how many people, how sensitive it is, and what harm could realistically follow. This is the risk assessment that decides whether the breach is notifiable to the ICO, whether you must also tell the individuals, or whether it is low risk and log-only. Record the decision and the reasons either way.
By 72 hours (report if required). If the breach is reportable, submit it to the ICO even if some details are still unknown; use the “report early, update later” approach and flag what you are still investigating. If you have decided not to report, make sure the breach and your reasoning are in the internal log. Only then turn to the slower work: root-cause analysis, fixing the weakness, and lessons learned so the same breach cannot recur.
When do you have to tell the people affected?
Reporting to the ICO and telling the affected individuals are two separate duties with two different thresholds, and it is easy to confuse them. Article 34 of the UK GDPR says that “when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.”
Note the difference in the threshold. You report to the ICO where there is a risk; you must also tell the individuals only where there is a high risk. A high risk is one with a greater likelihood or severity of harm — for example a breach exposing bank details, passwords, health records or information that could put someone in physical danger. The purpose of telling people is practical: it lets them protect themselves, for instance by changing passwords, watching their bank accounts or being alert to scams. Article 34 says the communication must be in “clear and plain language” and must describe the nature of the breach and the same core information given to the ICO.
There are narrow exceptions. Article 34 says you need not tell individuals if you had already applied protective measures such as encryption that render the data unintelligible to anyone unauthorised, or if you have since taken steps that ensure the high risk is no longer likely to materialise, or if telling them individually would involve disproportionate effort — in which case a public communication is used instead. In practice, relying on an exception is a decision to document carefully rather than to reach for lightly.
Do telecoms and internet providers have a different duty?
Yes. Providers of public electronic communications services — telecoms companies and internet service providers — have their own breach-notification duty under the Privacy and Electronic Communications Regulations 2003 (PECR), which sits alongside the UK GDPR rather than replacing it. Under regulation 5A of PECR, a service provider must notify a personal data breach to the ICO “without undue delay and, where feasible, not later than 72 hours after having become aware of it,” and must also tell the affected subscriber or user where the breach is likely to adversely affect their personal data or privacy.
This is worth flagging because the position recently changed. The 72-hour wording in PECR was inserted by the Data (Use and Access) Act 2025 and took effect in August 2025, bringing the PECR deadline into line with the UK GDPR standard; before that, communications providers worked to a tighter notification expectation under the older retained EU rules. If you operate in the telecoms or internet-access sector, check the current regulation 5A rather than relying on older guidance, because the PECR regime also carries its own separate record-keeping and content requirements.
What are the penalties and fines for a data breach?
Two points cut through the alarmist headlines here. The first is that a breach itself is not automatically an offence; the enforcement risk comes from how you handle it — failing to have adequate security, failing to report when you should, or failing to protect people. The second is that the ICO fines far less often than the headlines suggest. In practice it issues many more reprimands, enforcement notices and warnings than monetary penalties, and the largest fines are reserved for the most serious, systemic failures.
That said, the ceilings are high. The Data Protection Act 2018, together with the UK GDPR, sets a two-tier maximum. The standard maximum is up to £8.7 million or 2% of total annual worldwide turnover, whichever is higher. The higher maximum — which applies to breaches of the core data protection principles, the lawful bases, and individuals’ rights — is up to £17.5 million or 4% of total annual worldwide turnover, whichever is higher. These are the absolute ceilings, not a tariff; any actual penalty depends on the seriousness of the failure, the harm caused, and what the organisation did to prevent and respond to it.
It is worth being honest about what drives enforcement. Regulators tend to treat a prompt, candid report and a well-managed response far more favourably than a cover-up or a missed deadline. The reputational cost of a breach — lost trust, lost customers, the time and expense of putting things right — very often exceeds any fine, which is the real reason breach preparedness pays for itself.
How can organisations prepare for a data breach?
The organisations that handle breaches well are not the ones that never have them; everyone has incidents. They are the ones that have decided in advance who does what. A workable breach-response plan is short and covers four things: how staff recognise and raise an incident, who assesses the risk and makes the reporting decision, how the ICO report is actually submitted (and by whom, out of hours), and how affected individuals are told if the risk is high.
Underneath the plan sit two foundations. One is security: encryption of laptops and removable media, access controls so staff only see what they need, tested backups so ransomware does not become a permanent loss, and a measured approach to the human and technical risks that lead to most breaches. Our guide to cyber security training requirements sets out what staff at different levels need to know. The other foundation is awareness: most breaches start with an ordinary human error — a misaddressed email, a lost device, a phishing link — so staff who can recognise a breach and know to raise it immediately are worth more than any single piece of software.
Finally, keep the breach log live and use it. Reviewing your own incidents, even the minor ones, is how you spot the recurring weakness — the team that keeps emailing the wrong recipient, the device policy that keeps being ignored — before it becomes the breach that does cross the reporting threshold.
Train your team to recognise and report a breach
Nexis CPD’s Data Protection and GDPR Awareness course gives staff at any level the grounding they need to recognise a personal data breach, understand the 72-hour rule and know exactly who to tell. It sits naturally alongside the Cyber Security Awareness course, which covers preventing the incidents that cause most breaches, and — for schools and colleges — the Data Protection in Schools course, which applies the same rules to pupil records, safeguarding data and subject access requests. Together they make a solid data-protection grounding for a compliance induction.
£9 per course. CPD accredited, 100% online, verifiable e-certificate. Pay for 2, get 3 — any 3 courses for £18. These are awareness courses to support your organisation’s data protection programme, not regulated or legal qualifications.
Frequently asked questions
How long do you have to report a data breach?
Under Article 33 of the UK GDPR you must report a notifiable personal data breach to the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware of it. The 72 hours is clock time, so it includes evenings, weekends and bank holidays. If you miss the deadline you must still report and explain the reasons for the delay, and you can provide further detail in phases as your investigation continues.
Do I have to report every data breach to the ICO?
No. You only report a breach that is likely to result in a risk to the rights and freedoms of individuals, such as identity theft, financial loss, distress or the exposure of sensitive information. A breach where any risk is unlikely does not need to be reported to the ICO. However, under Article 33(5) you must still record every breach, including the ones you decide not to report, in an internal breach log along with your reasoning.
Who do you report a data breach to in the UK?
You report it to the Information Commissioner’s Office (ICO), not to the police, using the ICO’s online data breach reporting form or, for high-risk breaches, its telephone helpline. If the breach also involves a crime such as theft or hacking you may additionally report that to the police or Report Fraud (formerly Action Fraud), but the ICO is the data protection regulator you must notify under the UK GDPR.
When do you have to tell the people affected by a breach?
You must tell the affected individuals, without undue delay, only where the breach is likely to result in a high risk to their rights and freedoms, under Article 34 of the UK GDPR. The communication must be in clear and plain language so people can protect themselves. You need not tell them individually if the data was encrypted and unintelligible, if you have since removed the high risk, or if doing so would involve disproportionate effort, in which case a public notice is used instead.
What are the fines for a data breach in the UK?
The Data Protection Act 2018 and UK GDPR set a two-tier maximum. The standard maximum is up to £8.7 million or 2% of total annual worldwide turnover, whichever is higher. The higher maximum, for breaches of the data protection principles, lawful bases or individuals’ rights, is up to £17.5 million or 4% of worldwide turnover, whichever is higher. These are ceilings, not set penalties; in practice the ICO issues far more reprimands and enforcement notices than fines.
This article is general information about reporting a personal data breach in the UK and is not legal advice. Whether a breach is notifiable, and to whom, depends on the specific facts and the level of risk. For a particular situation, consult your data protection officer or a qualified professional and refer to the current UK GDPR, the Data Protection Act 2018 and the ICO’s guidance.