In one sentence: If you have a personal data breach that is likely to put people at risk, UK law says you must tell the ICO as soon as possible and, where feasible, within 72 hours of finding out.

What it is

The ICO defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It is more than a hack: the ICO says it can be an email sent to the wrong person, a laptop stolen from a car, or files lost in a flood.

UK GDPR requires you to assess the likely risk to people’s rights and freedoms. If a risk is likely, you must notify the ICO as soon as possible and, where feasible, within 72 hours of becoming aware of the breach.

How it works

1. Contain it and find out what happened to the personal data. The ICO says to recover the data if you can and protect the people most affected.
2. Start a log straight away, even if you may not need to report. The ICO says you must record every breach, whether or not you report it.
3. Assess the risk of harm to people, such as identity theft, safeguarding problems or distress.
4. If a risk is likely, report to the ICO within 72 hours of becoming aware. You can report in phases. The ICO says the important part is telling them before 72 hours pass, and you can send more details later.
5. If the breach is likely to result in a high risk, tell the affected people without undue delay.
6. Learn and fix.

The clock starts when you become aware, not when the breach began. If you report late you must explain why.

Who it affects and how badly

Every organisation that handles personal data, including sole traders. The ICO has a simple guide specifically for small organisations.

Accountancy and legal practices, healthcare and care providers, schools, charities, estate agents and recruitment firms hold sensitive data and often send emails and files to the wrong person. Retail and hospitality firms hold customer data. Councils hold citizen records. Fintech, insurers and telecoms have extra duties. Communications providers must also report under PECR, and since 20 August 2025 that deadline is also 72 hours.

A breach affecting people in the EU also engages the EU GDPR, as the ICO notes. Worst case: late or missed reporting can itself be a breach, on top of the original incident.

Real examples

23andMe, 2023. The ICO says the company only began a full investigation in October 2023, after an employee found stolen data advertised for sale, having dismissed earlier warnings, and only then confirmed a breach. A law firm summary of the ICO’s penalty notice says the company failed to notify the ICO within the statutory time limit and to keep appropriate records. The ICO fined it £2.31 million for security failings and a slow response. Sources: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/ and https://www.lewissilkin.com/en/insights/2025/07/05/ico-fines-23andme-2-3-million-key-takeaways-on-security-measures-and-data-brea-102krc5

How to detect it

A breach cannot be reported if nobody notices it.

• Tell staff that a misdirected email or lost device is a breach, and who to tell immediately.
• Set up alerts for unusual sign-ins, mailbox rules, mass downloads and new admin accounts. In Microsoft 365, use the audit log and Defender alerts. In Google Workspace, use the Alert Center.
• Check breach notifications from suppliers.
• Treat outside warnings, such as someone telling you data is for sale, as possible breaches. 23andMe’s delay is a lesson.
• Check staff credentials against known breaches.

How to fix or prevent it

1. Write a short breach plan that names who decides, who reports and who contacts customers.
2. Put the ICO’s template log somewhere everyone can find it.
3. Know the ICO’s breach advice line, 0303 123 1113, and its self-assessment tool.
4. Put in place the controls that prevent breaches: MFA, patching, backups and least privilege.
5. Encrypt laptops and phones so a loss may not be a reportable risk.
6. Rehearse the first 72 hours once a year.
7. Record any decision not to report, with the reasons.

Related terms

• uk gdpr
• double extortion
• ransomware
• credential stuffing
• indicators of compromise
• business email compromise

Browse all entries in the credentials and exposure hub.

FAQ

When does the 72 hours start? From when you become aware of the breach, not when it happened.

Do I report every breach? No. You report to the ICO if the breach is likely to result in a risk to people. You must still record every breach.

Can I report late or in parts? You can report in phases, but if you report after 72 hours you must give reasons for the delay.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy.