When a personal data breach hits your organisation, the clock starts immediately. Under UK GDPR, you have 72 hours to complete your ICO data breach reporting, and that window is tighter than most businesses realise. Miss it, and you could face enforcement action, fines, or reputational damage that far outweighs the original incident. Getting the process right from the start matters.
This guide walks you through the exact timelines, thresholds, and steps required to report a breach to the Information Commissioner’s Office. You’ll learn when reporting is mandatory, what information the ICO expects, and how to determine whether your breach meets the reporting threshold. No guesswork, no legalese, just a clear, practical breakdown.
At TrustedIA, we support UK businesses through every stage of cyber incident response, from initial containment to regulatory reporting and recovery. With over 30 years of experience in IT security and managed services, including ISO 27001 implementation and our dedicated CyberSOS Incident Response service, we’ve helped organisations respond to breaches quickly and effectively. This guide reflects that hands-on knowledge.
Step 1. Confirm it is a personal data breach
Before you consider ICO data breach reporting, you need to establish that what happened actually qualifies as a personal data breach under UK GDPR. A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Not every IT issue or security event meets this definition, so confirm what type of data is involved before you do anything else.
A breach does not have to involve a hacker. Sending an email to the wrong recipient, losing an unencrypted USB drive, or accidentally deleting a customer database all qualify as personal data breaches under UK GDPR.
What counts as personal data
Personal data is any information that can identify a living individual, either directly or indirectly. This includes names, email addresses, IP addresses, location data, health records, financial details, and even combinations of information that together point to a specific person. Special category data – such as health, biometric, or racial origin information – carries a higher risk profile and will directly affect your reporting obligations in Step 2.
Breach types to check against
Not every security incident qualifies as a breach. Use this quick checklist to confirm your situation meets the threshold:
- Confidentiality breach: Unauthorised or accidental disclosure of personal data (e.g., wrong email recipient, exposed database)
- Integrity breach: Unauthorised or accidental alteration of personal data (e.g., records modified without authorisation)
- Availability breach: Accidental or unlawful loss of access to personal data (e.g., ransomware locking files, accidental deletion)
If your incident fits at least one of these categories and involves personal data, you have confirmed a breach. Move to Step 2 to assess whether you must notify the ICO.
Step 2. Assess risk and decide if you must notify
Under the UK GDPR, not every confirmed breach requires reporting to the ICO. You only need to notify the ICO if the breach is likely to result in a risk to individuals’ rights and freedoms. Where that risk is unlikely, you must still log the breach internally, but mandatory ICO notification does not apply.
The two-part threshold
The ICO expects you to apply a clear risk assessment before deciding whether to report. First, determine whether the breach poses any risk to the people whose data is involved. Second, judge whether that risk is likely rather than remote. This table shows how the threshold maps to your obligations:
| Risk level | Notify the ICO | Notify individuals |
|---|---|---|
| No risk | No | No |
| Risk likely | Yes | No |
| High risk likely | Yes | Yes |
High-risk factors to weigh
Certain characteristics push a breach toward high risk, triggering notification to both the ICO and the affected individuals. Assess these factors in every incident:
- Special category data involved (health, biometric, or ethnic origin information)
- A large volume of individuals affected
- Financial or identity data exposed in a way that enables fraud
- Vulnerable people in the affected group
If you cannot confidently rule out meaningful risk, treat the breach as reportable. ICO data breach reporting exists precisely to protect individuals when organisations are uncertain.
Step 3. Act within 72 hours and keep a breach log
The 72-hour window begins the moment your organisation becomes aware of the breach, not when you finish investigating it. If the deadline falls outside business hours, the clock does not pause. Report as much as you know by the deadline and inform the ICO that you will provide further details once your investigation is complete.
If you miss the 72-hour deadline, include a clear explanation of the delay in your ico data breach reporting submission. The ICO considers delays on a case-by-case basis, but undue delay without justification will work against you.
What your breach log must contain
You must maintain an internal breach register regardless of whether you notify the ICO. UK GDPR requires this record for every breach, reportable or not. Your log must capture:
- Date and time the breach was discovered, and the estimated time it occurred
- A description of the breach type (confidentiality, integrity, or availability)
- Categories and approximate number of individuals affected
- The personal data involved and its sensitivity
- Likely consequences of the breach for affected individuals
- Remediation and containment steps taken, and by whom
Step 4. Report to the ICO using the right route
Once you confirm the breach is reportable, submit your notification via the ICO’s online reporting tool on the ICO website. Keep your breach log open before you start the form, as it asks for specific details you should have already documented in Step 3. The ICO does not expect a polished corporate statement – it expects accurate, factual information about what happened, who is affected, and what steps you have already taken.
What the ICO form asks for
Your ICO data breach reporting submission must cover six core areas. Preparing this information before you open the form lets you complete it in one session without having to pause and search for details mid-way through:
| Field | What to include |
|---|---|
| Nature of the breach | Type (confidentiality, integrity, availability) and how it occurred |
| Data categories | Types of personal data and whether special category data is involved |
| Number of individuals | Approximate count of people affected |
| Likely consequences | The probable impact on those individuals |
| Measures taken | Containment and remediation steps have already been completed |
| Contact details | Name and contact information of your Data Protection Officer or equivalent |
If your investigation is still ongoing at the 72-hour mark, submit what you know and flag clearly that further information will follow.
Step 5. Tell affected people and follow up
When the ICO determines that your breach carries a high risk to individuals, notifying those people is a legal requirement. You must contact affected individuals without undue delay, using clear, plain language that explains what happened and what they should do to protect themselves. Avoid vague reassurances, because people need specific, actionable information to make decisions about their own safety.
Do not wait for the ICO to instruct you to notify individuals. If high risk is established in Step 2, prepare your communication at the same time as your ico data breach reporting submission.
What your notification to individuals must include
Your message to affected individuals must cover four essential points: a description of the breach, the name and contact details of your Data Protection Officer, the likely consequences for those affected, and the steps you have taken or recommend they take. Keep the language direct and free of technical terms.
- What personal data was involved, and how it was exposed
- Who to contact with questions or concerns
- Immediate protective steps the individual should take (e.g., change passwords, monitor bank statements)
- Any support or resources your organisation is providing
After notifying individuals, document every communication you send, including the date, channel, and content. The ICO may request evidence that you met your notification obligation, and a clear record protects your organisation during any subsequent review.
Keep control after you report
Submitting your ICO data breach reporting notification is not the final step. The ICO may follow up with questions, request additional documentation, or open a formal investigation depending on the severity of the breach. Keep your breach log up to date throughout this period and designate a single point of contact to handle all ICO correspondence. A disorganised response after submission can create more problems than the breach itself.
Your organisation should also conduct a post-breach review once the immediate incident is contained. Identify what failed, whether that was a technical control, a human process, or a gap in staff training, and implement changes before the same vulnerability is exploited again. Document every remediation step you take, as the ICO views proactive improvement favourably.
If your team lacks the internal resources to confidently manage breach response and regulatory reporting, TrustedIA’s CyberSOS Incident Response service provides expert support from containment through to recovery and compliance.
