The Assurance Desk
Part of the guide A data breach has happened: who do you call?
What counts as a personal data breach?
A breach can involve data being lost, destroyed, changed without permission, disclosed or accessed by someone who should not have it. It can happen by accident as well as through an attack.
Staff need a clear way to raise an incident with the person who will assess it. Once aware, contain the breach and assess the possible harm to people, including how serious and likely that harm is.
From incident to reporting decision
- Raise it Tell the person or team handling incidents.
- Contain and assess Check what happened and the likely harm to people.
- Report when required Apply the ICO and affected-person thresholds.
- Keep the record Record the breach even if no report is needed.
When do you tell the ICO or the people affected?
These are different thresholds. Risk that is likely triggers the ICO report. High risk also triggers a direct notice to the people concerned. Neither decision is just a count of how many records were involved.
| Assessment | Action |
|---|---|
| Risk to people is unlikely | No ICO report is required, but record the breach. |
| Risk to people is likely | Notify the ICO without undue delay and within 72 hours of awareness. |
| Risk to people is high | Also tell affected people directly without undue delay. |
Do you wait until the investigation is finished?
No. The ICO allows information to be supplied in phases without undue further delay. If a report is late, you must explain the delay. The clock for a notifiable breach starts when you become aware, not when every detail is known.
Keep the known facts and open questions separate. Ask who will provide the next update and when, rather than waiting for one final report.
What if the breach happened at a supplier?
A processor, a supplier using personal data on your behalf, must tell the controller without undue delay once it becomes aware of a breach. That is a separate duty from the controller’s report to the ICO.
Your records should cover all breaches, whether or not they reach the ICO threshold. Other laws may add reporting duties, and you may also need to consider the police, insurers or other relevant bodies.
What to do
- Make sure staff know where to raise an incident.
- Record when awareness began and assess the likely harm to people.
- Apply the ICO threshold and the separate high-risk threshold for telling people.
- Send a required report in time and supply further details in phases if needed.
- Keep the breach record, including when no ICO report is needed.
Common questions
Does every security incident need an ICO report?
No. First assess whether it is a personal data breach and whether risk to people is likely. A breach with unlikely risk does not need an ICO report, but must still be recorded.
Do you have 72 hours to tell affected people?
The rule for affected people is different: where high risk is likely, tell them directly without undue delay. The 72-hour limit concerns the report to the ICO.
Where next
Sources
- ICO, Personal data breaches: a guide, checked 7 October 2026
This is an independent editorial guide, not legal advice.