# When must you report a personal data breach? Check the risk to people, then use the right reporting route and deadline. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md). **The short answer.** Report a UK personal data breach to the ICO if risk to people is likely. Do so without undue delay and within 72 hours of becoming aware. If the risk is high, also tell the affected people without undue delay. Keep a record even when a breach does not need reporting ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## What counts as a personal data breach? A breach can involve data being lost, destroyed, changed without permission, disclosed or accessed by someone who should not have it. It can happen by accident as well as through an attack ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). Staff need a clear way to raise an incident with the person who will assess it. Once aware, contain the breach and assess the possible harm to people, including how serious and likely that harm is ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). **From incident to reporting decision** 1. Raise it: Tell the person or team handling incidents. 2. Contain and assess: Check what happened and the likely harm to people. 3. Report when required: Apply the ICO and affected-person thresholds. 4. Keep the record: Record the breach even if no report is needed. Assess the effect on people while work to contain the incident continues. Source: ICO, Personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 7 October 2026) ## When do you tell the ICO or the people affected? These are different thresholds. Risk that is likely triggers the ICO report. High risk also triggers a direct notice to the people concerned. Neither decision is just a count of how many records were involved ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). **The UK GDPR reporting thresholds** | Assessment | Action | | --- | --- | | Risk to people is unlikely | No ICO report is required, but record the breach. | | Risk to people is likely | Notify the ICO without undue delay and within 72 hours of awareness. | | Risk to people is high | Also tell affected people directly without undue delay. | Source: ICO, Personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 7 October 2026) ## Do you wait until the investigation is finished? No. The ICO allows information to be supplied in phases without undue further delay. If a report is late, you must explain the delay. The clock for a notifiable breach starts when you become aware, not when every detail is known ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). Keep the known facts and open questions separate. Ask who will provide the next update and when, rather than waiting for one final report. ## What if the breach happened at a supplier? A processor, a supplier using personal data on your behalf, must tell the controller without undue delay once it becomes aware of a breach. That is a separate duty from the controller’s report to the ICO ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). Your records should cover all breaches, whether or not they reach the ICO threshold. Other laws may add reporting duties, and you may also need to consider the police, insurers or other relevant bodies ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## What to do 1. Make sure staff know where to raise an incident ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 2. Record when awareness began and assess the likely harm to people ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 3. Apply the ICO threshold and the separate high-risk threshold for telling people ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 4. Send a required report in time and supply further details in phases if needed ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). 5. Keep the breach record, including when no ICO report is needed ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## Common questions ### Does every security incident need an ICO report? No. First assess whether it is a personal data breach and whether risk to people is likely. A breach with unlikely risk does not need an ICO report, but must still be recorded ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ### Do you have 72 hours to tell affected people? The rule for affected people is different: where high risk is likely, tell them directly without undue delay. The 72-hour limit concerns the report to the ICO ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 7 October 2026). ## Where next - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md) - [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim.md) - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md) ## Sources - ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.