# A data breach has happened: who do you call? Get the right people involved, contain the breach and keep the reporting decisions clear. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. **The short answer.** Tell the person or team responsible for handling breaches and start containing the harm. Does the personal data breach create a likely risk to people’s rights and freedoms? If so, notify the ICO without undue delay, within 72 hours of awareness. High risk also means telling the people affected without undue delay ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## In this series - [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) ## Who should you contact first inside the business? Staff should know how to raise an incident with the person or team that can assess it. Bring in the people who can contain the problem and assess the likely harm to people. Do not wait until every detail is known ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). A personal data breach is not only a cyber attack. It can also involve accidental loss, changes to data or access by someone who should not have it ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## When must you report a breach to the ICO? The reporting test is about risk to people, rather than just disruption to your business. If that risk is likely, you must notify the ICO. If it is unlikely, you do not have to report it, but you still need to record the breach ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). The 72 hours is a limit, not a waiting period. If a report is late, explain the delay. You can provide information in phases, without further undue delay, while the facts become clearer ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). **Who needs to know, and when?** | Contact | When the duty applies | Timing | | --- | --- | --- | | ICO | The breach is likely to risk people’s rights and freedoms. | Without undue delay, within 72 hours of awareness. | | People affected | The breach is likely to create a high risk to their rights and freedoms. | Directly, without undue delay. | | Your customer, if you are its processor | You become aware of a breach affecting data you handle for it. | Without undue delay. | | Your breach record | Every personal data breach, including one not reported to the ICO. | Record the breach and the reporting decision. | Source: ICO, Personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 7 October 2026) ## Does reporting to the NCSC also tell the ICO? No. The government’s cyber incident reporting guidance says information given to the NCSC through that service is not shared with the ICO. Treat them as separate routes ([GOV.UK, Where to Report a Cyber Incident](https://www.gov.uk/guidance/where-to-report-a-cyber-incident), checked 7 October 2026). The NCSC responds to the most critical incidents affecting the UK. That is different from arranging the technical and data protection help your business needs for its own response ([GOV.UK, Where to Report a Cyber Incident](https://www.gov.uk/guidance/where-to-report-a-cyber-incident), checked 7 October 2026). ## Who else might need to be involved? Consider your insurer, the police, a professional body or a bank where relevant. They may help reduce financial harm. Other laws can also create reporting duties, so check the rules that apply to your organisation ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). If you handle the data for a customer as its processor, tell that customer without undue delay. Do not treat the ICO’s 72 hour limit as your own deadline for telling the customer ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## How can you make the next response easier? Keep the contact list and first actions easy to find. In her LinkedIn post, Lisa Forte argues that an incident plan needs to be easy to scan and use under pressure. That is a practical point about the plan, rather than a legal reporting rule ([Lisa Forte on LinkedIn](https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W), checked 7 October 2026). **A response people can follow** 1. Raise it: Tell the person or team responsible. 2. Contain and assess: Reduce the harm and assess the risk to people. 3. Notify when required: Meet the reporting duty with the facts available. 4. Record and update: Keep the breach record and provide further information. These actions can overlap. Containment and reporting do not have to wait for a complete investigation. Source: ICO, Personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 7 October 2026) > "If your plan can’t be grabbed, scanned, and acted on in seconds it’s not really a useable plan." > Lisa Forte, LinkedIn post excerpt > Lisa Forte on LinkedIn, Your Incident Response Plan may end up letting you down. Many organisations still worship the beautiful incident response plan. Glossy. Reviewed to death. Auditor‑approved. ……..And often totally…, https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W (checked 7 October 2026) > [View LinkedIn post](https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W) ## What to do 1. Find the person or team responsible for the response ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 2. Contain the breach and assess the likely harm to people ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 3. Check the ICO and affected people reporting tests separately ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 4. If you are a processor, tell the controller without undue delay ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 5. Record the breach and keep the information up to date ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## Common questions ### Must every personal data breach be reported to the ICO? No. Reporting depends on likely risk to people. You must still record a breach that does not need to be reported ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ### Can we wait until the investigation is finished? A reportable breach must be notified without undue delay and within 72 hours of awareness. Information can be supplied in phases without further undue delay ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ### Does the NCSC pass our report to the ICO? No. The government guidance says information given through that NCSC reporting service is not shared with the ICO ([GOV.UK, Where to Report a Cyber Incident](https://www.gov.uk/guidance/where-to-report-a-cyber-incident), checked 7 October 2026). ## Where next - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md) - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) - [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim.md) - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md) ## Sources - ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 7 October 2026) - GOV.UK, Where to Report a Cyber Incident: https://www.gov.uk/guidance/where-to-report-a-cyber-incident (checked 7 October 2026) - Lisa Forte on LinkedIn: https://www.linkedin.com/posts/lisa-forte_your-incident-response-plan-may-end-up-letting-activity-7432767009764917248-FP0W (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.