A data breach can hit without warning, a suspicious login, a ransomware note, or a call from a customer asking why their details are circulating online. In that moment, knowing how to respond to a data breach quickly and correctly is the difference between a contained incident and a full-blown crisis. For UK SMEs, the stakes are particularly high: the ICO can issue fines of up to £17.5 million, and you have just 72 hours to report a qualifying breach.
Yet most small and medium-sized businesses don’t have a rehearsed response plan sitting in a drawer. They scramble, make avoidable mistakes, and lose precious time when every minute counts. The legal obligations alone, under the UK GDPR and the Data Protection Act 2018, can feel overwhelming when you’re simultaneously trying to stop the bleeding and keep the business running.
This guide breaks the response process into seven clear steps, from initial containment through to regulatory reporting and post-incident review. It’s built on the kind of structured approach we follow at TrustedIA when our CyberSOS Incident Response team helps organisations recover from live cyber incidents. Whether you’re dealing with a breach right now or preparing for one that hasn’t happened yet, these steps will give you a practical framework you can act on immediately.
What counts as a data breach under UK GDPR
Under UK GDPR, a data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This definition is broader than most SME owners expect. You don’t need to suffer a sophisticated cyberattack for a breach to occur. Losing an unencrypted USB stick containing customer records, or accidentally CC’ing a client list to the wrong recipient, can both qualify as reportable breaches if they carry a risk to the rights and freedoms of the individuals whose data is involved.
The ICO’s position is clear: a breach doesn’t require malicious intent. Any unintended exposure of personal data can trigger your legal obligations under UK law.
The three categories of data breach
UK GDPR recognises three distinct breach types. Knowing which category you’re dealing with directly shapes how urgently you act and what notifications you must make. The table below summarises each type:
| Breach type | What it means | Common example |
|---|---|---|
| Confidentiality breach | Unauthorised or accidental disclosure of data | Email sent to the wrong person |
| Integrity breach | Unauthorised or accidental alteration of data | A malicious insider modifies financial records |
| Availability breach | Accidental or unauthorised loss of access to data | Ransomware encrypts your systems |
What doesn’t automatically trigger a report
Not every IT incident creates a legal obligation to notify the ICO. If someone attempts to access personal data without authorisation but fails, and no data was actually exposed, that is a security event rather than a reportable breach. Your obligation only activates when a breach poses a real risk to individuals, which is exactly why accurate initial assessment matters so much. Understanding these boundaries is the foundation of knowing how to respond to a data breach without over-reporting or, more dangerously, under-reporting.
Step 1–2. Start the clock and secure evidence
The moment you suspect a breach, two things must happen simultaneously: you start your 72-hour reporting clock and you begin preserving evidence. These first two steps dictate every decision that follows. Rushing past them costs you both legal standing and the forensic clarity you’ll need to understand what actually happened.
Step 1: Log the discovery time immediately
Record the exact date and time you first became aware of the incident, along with who identified it and how. This timestamp is your legal anchor under UK GDPR. Use a simple incident log entry like this:
Discovery timestamp: [DD/MM/YYYY HH:MM] | Reported by: [Name/Role] | Method of discovery: [e.g. user report, security alert, third-party notification]
Notify your designated data protection lead or DPO within the hour. Every minute you delay shrinks your 72-hour window.
Step 2: Secure and preserve evidence
Before anyone starts clicking around or rebooting systems, isolate affected devices without wiping them. Screenshot error messages, export relevant logs, and photograph physical evidence where applicable. Knowing how to respond to a data breach correctly means resisting the urge to remediate before you’ve captured what happened. Untouched evidence is critical for both your internal investigation and any regulatory inquiry.
Step 3–4. Contain the breach and stop exposure
With your evidence preserved, the next priority is stopping the damage from spreading. Containment and exposure control run in parallel: one closes the door the attacker used, the other ensures no additional personal data leaves your environment.
Step 3: Cut off the access point
Your immediate goal is to isolate the compromised system without destroying the evidence you secured in Steps 1 and 2. Disconnect affected machines from the network, revoke any credentials that may have been exposed, and block suspicious IP addresses at the firewall level. Use this checklist to work through containment systematically:
- Disconnect affected devices from the network (do not power them off)
- Reset passwords for compromised or potentially exposed accounts
- Revoke active sessions and API tokens linked to the breach
- Block identified malicious IP addresses or domains at the firewall
Step 4: Stop further data exposure
Once the access point is closed, audit what data remains at risk. Check whether any exfiltration is still in progress, for example an active outbound transfer or a cloud sync still running. Knowing how to respond to a data breach means acting before attackers finish what they started.
Containment is not remediation. Your goal here is to stop further exposure, not fix the underlying vulnerability, which comes in the post-incident review.
Step 5. Assess risk and decide on notifications
Once containment is in place, your next task is to measure the actual risk the breach creates for the individuals whose data was involved. This assessment drives two critical decisions: whether to notify the ICO and whether to contact affected individuals directly. Getting this wrong in either direction creates problems: over-reporting wastes resource, while under-reporting risks a fine.
Score the severity of the breach
Work through these four questions to determine the risk level before making any notification decision:
- What type of data was exposed (financial records, health data, login credentials)?
- How many individuals are affected?
- Could the exposure lead to discrimination, financial loss, or identity theft?
- Was the data encrypted or otherwise protected at the time of exposure?
If the exposed data includes special category data under UK GDPR, such as health or biometric information, treat it as high-risk immediately.
The two notification decisions you face
Knowing how to respond to a data breach requires separating two distinct obligations. Report to the ICO within 72 hours if the breach is likely to risk individual rights and freedoms. Separately, contact affected individuals directly only when the breach poses a high risk to those specific people. Low-risk incidents require neither notification, but you must document your reasoning internally regardless.
Step 6–7. Notify, document, and prevent repeats
With your risk assessment complete, you move into the final two steps: sending the right notifications and building a documented record that protects you both legally and operationally.
Step 6: Submit your ICO notification and contact affected individuals
If your assessment flags a notifiable breach, report to the ICO via their online portal within the 72-hour window. Your notification must cover:
- What personal data was involved
- How many individuals are affected
- The likely consequences of the breach
- The measures you have taken or plan to take
Where the breach poses a high risk to specific individuals, contact those people directly in plain language, explaining what happened and what steps they should take to protect themselves.
If you cannot submit a complete report within 72 hours, submit what you know and follow up with further detail as soon as it becomes available.
Step 7: Record every breach and review your controls
Every incident, whether reported or not, must be logged in your internal breach register. Knowing how to respond to a data breach correctly means treating documentation as a legal obligation, not an optional step. Once the incident is closed, run a post-incident review to identify the root cause and strengthen your controls before a similar incident occurs.
What to do next
Working through these seven steps gives you a clear structure for how to respond to a data breach, but preparation matters just as much as the response itself. Most UK SMEs that struggle during an incident do so because they have no documented plan, no assigned roles, and no tested processes before something goes wrong. Building those foundations now means your team acts with confidence rather than uncertainty when the pressure is on.
Start by assigning a designated data protection lead and drafting a one-page incident response checklist your staff can follow immediately. Review your breach register template, confirm you have access to the ICO reporting portal, and check whether your current security controls would have prevented the incident you just read about.
If you want expert support building that readiness, or you need a team ready to respond when a live incident hits, speak to TrustedIA’s cyber incident response specialists and get a plan in place before you need one.
