UK Data Breach Reporting: The 72-Hour ICO Rule

If your organisation suffers a personal data breach, UK GDPR Article 33 requires you to notify the Information Commissioner's Office within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. Miss that without good reason and the failure is itself a fineable infringement.

This page covers the operational mechanics of breach reporting for organisations. For the wider UK framework (lawful bases, data subject rights, the Data (Use and Access) Act 2025, EU adequacy), see our United Kingdom data privacy laws overview.

What counts as a personal data breach

A personal data breach is broader than most people assume. The ICO defines it as a security incident affecting the confidentiality, integrity or availability of personal data, the three elements security professionals call the CIA triad. There is a breach whenever personal data is lost, destroyed, corrupted or disclosed without authorisation, whenever someone accesses or passes on data without authority, and whenever data is made unavailable, for example when ransomware encrypts it or a backup is accidentally deleted. A confidentiality breach is unauthorised disclosure or access. An integrity breach is unauthorised alteration. An availability breach is loss of access to, or destruction of, the data. Crucially, a breach can be accidental as well as deliberate: a misdirected email, a lost unencrypted laptop, or paper files left on a train all qualify. A security incident only becomes a personal data breach when it involves personal data, so the threshold question is always whether identifiable information was affected.

Watch out: temporary loss of access counts. If a system outage or a ransomware lock means you cannot reach personal data when you need it, that is an availability breach even if the data is eventually recovered intact.

When you must report to the ICO, and when you do not

Not every breach is notifiable. Under Article 33(1), you report unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons." In practice that means you must assess, for each breach, the likelihood and severity of harm to the people whose data is involved. Risk to rights and freedoms includes physical, material and non-material damage such as discrimination, identity theft or fraud, financial loss, damage to reputation, loss of confidentiality, or any other significant economic or social disadvantage. If a risk to people is likely, you must report. If a risk is unlikely, you do not report to the ICO, but you must still record the breach internally. The ICO publishes a self-assessment tool and worked examples to help controllers reach a defensible decision, and runs a personal data breach advice line on 0303 123 1113 for organisations that are unsure.

The ICO's own examples illustrate the line. A lost unencrypted laptop holding unredacted sensitive case files is reportable, because the controller cannot rule out access and so cannot be sure people are not at risk. By contrast, a stolen device whose data was strongly encrypted, with no other copies compromised, may not meet the threshold. The test is not whether harm has occurred but whether it is reasonably likely.

The 72-hour clock and how it works

You do not have to finish investigating before you report. If you suspect a notifiable breach but are still establishing the facts, it is better to make an initial report within 72 hours and supply further detail as your investigation progresses. The first practical step on discovering a breach is to contain it (for example, by recovering data, shutting down a compromised account, or attempting to recall a misdirected email) and then to assess the risk.

What the notification must contain

Article 33(3) sets out the minimum content of a report to the ICO. The notification must describe the nature of the breach, including, where possible, the categories and approximate number of individuals affected and the categories and approximate number of personal data records concerned. It must give the name and contact details of your data protection officer or other contact point where more information can be obtained. It must describe the likely consequences of the breach. And it must describe the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate any adverse effects on individuals. Reports are made through the ICO's online "report a breach" service, or by telephone for organisations that cannot use the online route. Because phased reporting is allowed, the approximate figures and best current assessment are acceptable in a first report; precise numbers can follow.

Telling affected individuals (Article 34)

The high-risk threshold for telling individuals is deliberately higher than the threshold for telling the ICO, so a breach can be reportable to the regulator without triggering individual notification. Where it is triggered, the communication must be in clear, plain language and tell people what happened, who to contact, the likely consequences, and what you are doing about it, so they can take protective steps such as changing passwords or watching for fraud. Article 34(3) provides three exceptions where direct notification is not required: where you had applied appropriate protection measures, such as encryption, that render the data unintelligible to anyone unauthorised; where you have since taken steps ensuring the high risk is no longer likely to materialise; or where direct notification would involve disproportionate effort, in which case you must instead make a public communication or similar measure that informs people equally effectively. Under Article 34(4) the ICO can override a controller's decision and require individuals to be told.

Watch out: even if you rely on an Article 34 exception to avoid telling individuals, you may still have to report the breach to the ICO, and you must still document your reasoning.

The duty to document every breach

Article 33(5) requires controllers to document any personal data breach, comprising the facts of the breach, its effects, and the remedial action taken, in a way that lets the ICO verify compliance. This duty applies to all breaches, including those you assess as not notifiable. In practice that means keeping an internal breach register or log. The ICO recommends having a documented internal breach-reporting procedure so staff know how to escalate incidents quickly and so the organisation can make and record a defensible decision about whether to notify. A good register captures the date and time of discovery, what happened, the categories and rough number of people and records affected, your risk assessment and the reasoning for reporting or not reporting, whether the ICO and individuals were told, and the steps taken to contain and prevent recurrence. The register is itself accountability evidence: if the ICO investigates, it is how you show your decisions were reasonable.

Penalties for failing to report

Failing to notify the ICO when required is treated as an infringement in its own right, separate from whatever caused the breach. It falls in the standard tier, carrying a maximum fine of GBP 8.7 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. The underlying security failure that allowed the breach can attract the higher tier, up to GBP 17.5 million or 4% of global turnover, so a poorly handled breach can expose an organisation to penalties on more than one front. Beyond fines, the ICO can issue enforcement notices and reprimands. The practical lesson is that a prompt, honest report, even an incomplete one made within 72 hours, is far safer than a delayed or absent one.

Practical breach-response steps

1. Detect and escalate fast. Have a clear internal procedure so any staff member knows who to alert the moment they suspect a breach; the 72-hour clock starts when the organisation becomes aware.
2. Contain the incident. Recover data where you can, shut down compromised accounts or systems, and attempt to recall or delete misdirected information.
3. Assess the risk to people. Use the ICO self-assessment tool to weigh likelihood and severity of harm and decide whether the breach is notifiable.
4. Report to the ICO within 72 hours through the online service if a risk is likely, supplying the Article 33(3) information and reasons for any delay.
5. Notify affected individuals without undue delay where the breach is likely to result in a high risk, unless an Article 34(3) exception applies.
6. Record everything in your breach register, including breaches you decide not to report, and capture the lessons learned to prevent recurrence.