The Assurance Desk
Who should you contact first inside the business?
Staff should know how to raise an incident with the person or team that can assess it. Bring in the people who can contain the problem and assess the likely harm to people. Do not wait until every detail is known.
A personal data breach is not only a cyber attack. It can also involve accidental loss, changes to data or access by someone who should not have it.
When must you report a breach to the ICO?
The reporting test is about risk to people, rather than just disruption to your business. If that risk is likely, you must notify the ICO. If it is unlikely, you do not have to report it, but you still need to record the breach.
The 72 hours is a limit, not a waiting period. If a report is late, explain the delay. You can provide information in phases, without further undue delay, while the facts become clearer.
| Contact | When the duty applies | Timing |
|---|---|---|
| ICO | The breach is likely to risk people’s rights and freedoms. | Without undue delay, within 72 hours of awareness. |
| People affected | The breach is likely to create a high risk to their rights and freedoms. | Directly, without undue delay. |
| Your customer, if you are its processor | You become aware of a breach affecting data you handle for it. | Without undue delay. |
| Your breach record | Every personal data breach, including one not reported to the ICO. | Record the breach and the reporting decision. |
Does reporting to the NCSC also tell the ICO?
No. The government’s cyber incident reporting guidance says information given to the NCSC through that service is not shared with the ICO. Treat them as separate routes.
The NCSC responds to the most critical incidents affecting the UK. That is different from arranging the technical and data protection help your business needs for its own response.
Who else might need to be involved?
Consider your insurer, the police, a professional body or a bank where relevant. They may help reduce financial harm. Other laws can also create reporting duties, so check the rules that apply to your organisation.
If you handle the data for a customer as its processor, tell that customer without undue delay. Do not treat the ICO’s 72 hour limit as your own deadline for telling the customer.
How can you make the next response easier?
Keep the contact list and first actions easy to find. In her LinkedIn post, Lisa Forte argues that an incident plan needs to be easy to scan and use under pressure. That is a practical point about the plan, rather than a legal reporting rule.
A response people can follow
- Raise it Tell the person or team responsible.
- Contain and assess Reduce the harm and assess the risk to people.
- Notify when required Meet the reporting duty with the facts available.
- Record and update Keep the breach record and provide further information.
If your plan can’t be grabbed, scanned, and acted on in seconds it’s not really a useable plan.
What to do
- Find the person or team responsible for the response.
- Contain the breach and assess the likely harm to people.
- Check the ICO and affected people reporting tests separately.
- If you are a processor, tell the controller without undue delay.
- Record the breach and keep the information up to date.
Common questions
Must every personal data breach be reported to the ICO?
No. Reporting depends on likely risk to people. You must still record a breach that does not need to be reported.
Can we wait until the investigation is finished?
A reportable breach must be notified without undue delay and within 72 hours of awareness. Information can be supplied in phases without further undue delay.
Does the NCSC pass our report to the ICO?
No. The government guidance says information given through that NCSC reporting service is not shared with the ICO.
Where next
Sources
- ICO, Personal data breaches: a guide, checked 7 October 2026
- Lisa Forte on LinkedIn, Your Incident Response Plan may end up letting you down. Many organisations still worship the beautiful incident response plan. Glossy. Reviewed to death. Auditor‑approved. ……..And often totally…, checked 7 October 2026
- GOV.UK, Where to Report a Cyber Incident, checked 7 October 2026
This is an independent editorial guide, not legal advice.