# After a data breach: what UK law asks of you

The clock starts when you find out, so it helps to know the steps before you need them.

**The short answer.** UK law says you must report a breach to the UK data protection regulator if it is likely to put people at risk. Do it without undue delay and, where feasible, within 72 hours of becoming aware of it. The regulator is the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO), which took that name on 30 September 2026. Every breach goes in your own record, reported or not ([UK GDPR Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), [S.I. 2026/1015](https://www.legislation.gov.uk/uksi/2026/1015/made) and [the ICO](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/), checked 2 October 2026).

Reporting is not the only duty. If the risk to people is high, UK law says you must also tell them directly and without undue delay. If a supplier that handles data for you had the breach, it must tell you without undue delay once it knows (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 29 September 2026).

Some organisations handle a breach with their own team. Others bring in a data protection adviser, and a solicitor too if a legal claim looks likely. The [guide to choosing a data protection adviser](/guides/how-to-choose-a-data-protection-adviser) covers the wider questions.

**The first steps after a breach**

1. Contain it: Stop it going further, and note when you found out.
2. Judge the risk: Ask how likely and how serious the harm to people could be.
3. Report it if needed: If people are likely to be at risk, tell the UK data protection regulator without undue delay, within 72 hours where feasible.
4. Tell the people affected: Do this directly if the risk to them is high.
5. Record it: Log every breach, reported or not, with what you did.

What UK law and the ICO guidance ask of you, in order.

Source: ICO, personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026)

> "Some personal data breaches will not lead to risks beyond possible inconvenience to those who need the data to do their job."
> The ICO, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026)

## What to do after a personal data breach: the first steps

1. Write down the date and time you found out, and keep every log, email and screenshot from then on.
2. Contain the breach, then judge the risk to people. Write down your reasoning, whichever way you decide.
3. If you must report, do it without undue delay and, where feasible, within 72 hours. You can send the details in stages (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 29 September 2026).
4. Tell the people affected directly if the risk to them is high, with advice on how to protect themselves.
5. Record every breach, reported or not, with the facts, the effects and what you did.
6. If you bring in outside help, read what your current contract covers first, and agree any extra fee in writing.

## The 29 providers for this situation

Grouped by type, alphabetical inside each type.

### Advisory firms (27)

- [Bird & Bird LLP](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk.md): Advisory firm
- [Bratby Law](https://theassurancedesk.com/advisers/bratby-law.md): Advisory firm
- [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm
- [Data GRC Ltd](https://theassurancedesk.com/advisers/data-grc.md): Advisory firm
- [Data Protection People](https://theassurancedesk.com/advisers/data-protection-people.md): Advisory firm
- [Debbie Reynolds Consulting LLC](https://theassurancedesk.com/advisers/debbie-reynolds-consulting-llc.md): Advisory firm
- [DPO-Service](https://theassurancedesk.com/advisers/dpo-service.md): Advisory firm
- [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm
- [Forvis Mazars](https://theassurancedesk.com/advisers/forvis-mazars.md): Advisory firm
- [GDPR Advisor (PSA Professional Solutions)](https://theassurancedesk.com/advisers/gdpr-advisor.md): Advisory firm
- [Gowling WLG (UK) LLP](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp.md): Advisory firm
- [GRCI Law](https://theassurancedesk.com/advisers/grci-law.md): Advisory firm
- [Handley Gill](https://theassurancedesk.com/advisers/handley-gill.md): Advisory firm
- [HewardMills](https://theassurancedesk.com/advisers/hewardmills.md): Advisory firm
- [Hope & May](https://theassurancedesk.com/advisers/hope-and-may.md): Advisory firm
- [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm
- [KPMG LLP (UK)](https://theassurancedesk.com/advisers/kpmg-llp-uk.md): Advisory firm
- [Meditology Services, LLC](https://theassurancedesk.com/advisers/meditology-services.md): Advisory firm
- [Mishcon de Reya LLP](https://theassurancedesk.com/advisers/mishcon-de-reya-llp.md): Advisory firm
- [Osborne Clarke LLP](https://theassurancedesk.com/advisers/osborne-clarke-llp.md): Advisory firm
- [Pembroke Privacy](https://theassurancedesk.com/advisers/pembroke-privacy.md): Advisory firm
- [RPC (Reynolds Porter Chamberlain LLP)](https://theassurancedesk.com/advisers/rpc-reynolds-porter-chamberlain.md): Advisory firm
- [Samurai Digital Security Limited](https://theassurancedesk.com/advisers/samurai-digital-security-limited.md): Advisory firm
- [Securys](https://theassurancedesk.com/advisers/securys.md): Advisory firm
- [SME Comply](https://theassurancedesk.com/advisers/sme-comply.md): Advisory firm
- [Strategic Management Services, LLC](https://theassurancedesk.com/advisers/strategic-management-services.md): Advisory firm
- [Winston Taylor UK LLP (formerly Taylor Wessing)](https://theassurancedesk.com/advisers/winston-taylor-uk.md): Advisory firm

### Software products (2)

- [Metomic](https://theassurancedesk.com/advisers/metomic.md): Software product
- [Osano](https://theassurancedesk.com/advisers/osano.md): Software product

## Reporting a data breach: common questions

### Do we have to report every breach?

No. You report a breach when it is likely to put people's rights and freedoms at risk. You must still keep a record of every breach, with the facts, its effects and what you did about it (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/) and the [UK GDPR, Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 29 September 2026).

### What if we miss the 72 hours?

If you miss the 72 hours, report the breach anyway. A late report must give the reasons for the delay ([UK GDPR Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 29 September 2026).

### Do we need a lawyer or a consultant to answer the regulator?

You do not always need a lawyer or a consultant to answer the regulator. Some organisations reply with their own team. A data protection consultant can help you judge the risk, write the report and reply. A solicitor can help if a fine or a legal claim looks likely.

### We are in the US. Do the same rules apply?

In the US, different rules apply. Every US state has its own law on telling people about a breach of personal information (the [FTC](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business), checked 29 September 2026). Check which laws cover the people affected, including any outside the US.

## Where next

- [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident.md)
- [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)
- [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.