GDPR Q20
How do I report a data breach to the ICO?
Q20. How do I report a data breach to the ICO?
Category: Breaches
When a breach is likely to risk people’s rights and freedoms, you must notify the ICO within 72 hours and, in some cases, inform the affected individuals.
In simple terms
- Evaluate risk quickly to decide on notification.
- Provide required details in your report to the ICO.
- Communicate clearly with affected people when needed.
ICO notification
Article 33 requires controllers to report qualifying breaches to the ICO without undue delay. Include information about the nature of the breach, categories of data, approximate numbers affected, likely consequences, and measures taken.
- Submit reports via the ICO website or telephone for urgent cases.
- You can provide information in stages if details are not yet available.
- Maintain an internal log with timings and decisions, including reasons if you conclude notification is not required.
Informing individuals
If the breach is likely to result in a high risk to individuals, you must notify them directly. Use plain language and explain steps they can take to protect themselves.
- Describe the nature of the breach and the data involved.
- Provide contact details for further support.
- Share practical advice, such as changing passwords or monitoring accounts.
Practical steps to take
- Activate your incident response plan immediately.
- Assess impact and decide whether notification is required.
- Prepare the ICO report and submit within 72 hours.
- Craft clear messages for affected individuals if needed.
- Review the incident afterwards to strengthen controls.
Real-life examples
Ransomware attack
A healthcare provider loses access to patient records. Because sensitive data is involved, it notifies the ICO within 24 hours and informs patients about the risk.
Email mis-send
An email containing personal data is sent to the wrong client. The organisation assesses the risk as low and records the incident without notifying the ICO.
Helpful reminders
- Keep breach response templates ready to save time.
- Practice incident scenarios so staff know their roles.
- Update policies after each incident review.
Key takeaway
Act fast, be transparent, and learn from each incident—responsible reporting protects individuals and your organisation.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.