Under the UK GDPR, you must tell the Information Commissioner’s Office (ICO) about a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The exception is a breach that is unlikely to risk people’s rights and freedoms. That is the core of GDPR breach reporting. The detail that matters is how you judge risk, when the clock starts, what the report must contain and what you must record even when you don’t report.
This guide is written for Aberdeen and Aberdeenshire business owners and managers who need a clear process in place before an incident happens.
What counts as a reportable personal data breach
A personal data breach is a security failure that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The ICO’s guide to personal data breaches lists everyday examples:
- access by an unauthorised third party
- personal data sent to the wrong recipient
- a laptop or phone containing personal data being lost or stolen
- personal data altered without permission
- loss of availability of personal data
That last point catches many small businesses out. A ransomware attack that locks you out of customer or staff records is a breach even if nobody copies the data.
Not every breach has to go to the ICO. You only notify if the breach is likely to result in a risk to individuals, such as discrimination, damage to reputation, financial loss or loss of confidentiality. The ICO expects you to assess this case by case and be able to justify your decision. An email sent to the wrong colleague, containing nothing sensitive, is a very different matter from a customer list with bank details sent to an outside party.
The 72-hour rule and when the clock starts
The 72 hours run from the moment your organisation becomes aware of the breach, according to the ICO guidance. Awareness is not the date the breach actually happened. Guidance for the health sector describes it as the point where you have a reasonable degree of certainty that an incident has occurred and personal data has been compromised.
The clock does not pause for weekends or bank holidays. Make UK’s guidance gives the practical example: a breach found on a Friday afternoon reaches its deadline on the following Monday afternoon.
Two allowances help when facts are incomplete:
- If you can’t provide everything at once, the Data Protection Act 2018 allows information to be given in phases without undue further delay.
- If you miss 72 hours, the notification must explain the reasons for the delay.
The sensible reading is to report on what you know, then update. Waiting for a perfect picture is the usual way to miss the deadline.
Why out-of-hours readiness matters
Because the clock runs through nights and weekends, your ability to detect and respond outside office hours directly affects your GDPR breach reporting position. Our guide on out of hours IT support covers what UK businesses should know, and our piece on beating the ICO 72-hour clock looks at recovery planning.
How to report a breach to the ICO
You report online through the ICO’s breach reporting page. The ICO says the form takes about 30 minutes and cannot be saved and returned to later, so gather your facts first. It asks:
- what happened
- when and how you found out
- who is affected
- what you are doing about it
- who the ICO should contact
Don’t put the personal data itself in the form. For an initial report, the ICO says it will contact you within seven calendar days with next steps and a case reference number.
What the notification must contain
Under section 67 of the Data Protection Act 2018, the notification must include:
- the nature of the breach, with the categories and approximate numbers of individuals and records concerned
- the name and contact details of your data protection officer or another contact point
- the likely consequences of the breach
- the measures taken or proposed to deal with it and reduce its effects
Nominate your contact point in advance. Searching for who should sign off a report at 11pm on a Saturday wastes hours you don’t have.
What the ICO does with your report
The ICO uses notifications to decide what should happen next, to understand the cause and the mitigations in place, and to see where controls or processes failed. It may share information with law enforcement, cybercrime agencies or other regulators such as the FCA.
When you must also tell the people affected
Reporting to the ICO and telling individuals are separate duties. If a breach is likely to result in a high risk to people’s rights and freedoms, you must inform those concerned directly, without undue delay and in clear, plain language.
The ICO’s law enforcement guidance, which mirrors the same article of the UK GDPR, describes the circumstances in which that duty falls away:
- appropriate protections such as encryption make the data unintelligible to anyone who accessed it
- you have taken later steps that mean the high risk is no longer likely to materialise
- contacting people individually would involve disproportionate effort, in which case a public communication must be made instead
In practice, a lost unencrypted laptop holding staff payroll data is a likelier candidate for telling individuals than an encrypted one.
Record every breach, including the ones you don’t report
This is the part most often neglected. Whether or not you notify the ICO, you must record the facts of the breach, its effects and the remedial action taken, in a way that lets the ICO verify your compliance. That duty sits in the Data Protection Act 2018 and the ICO guide.
The ICO’s breach identification, assessment and logging toolkit recommends a breach log that:
- records the facts, the possible effects on affected people and the measures taken
- includes near misses
- feeds serious breaches into your information risk process
- is reviewed at senior level
- has a retention period with a lawful basis
Without proper logging, the toolkit warns, breaches may not be tracked, investigated or escalated, and may recur.
Good records often depend on good evidence. If a physical security system is involved, such as cameras on your premises, the rules on CCTV privacy laws in the UK are worth knowing when you log what was captured and what happened next.
Preparing before a breach happens
A 72-hour deadline is manageable when the groundwork is done. A sensible checklist for a small or medium-sized business:
- Know where personal data lives. Customer records, payroll, email, cloud storage and laptops all count.
- Name a decision-maker and a deputy who can judge risk and approve an ICO report.
- Write a short response plan. Our ransomware response plan guide is a useful template for the first hours of an incident.
- Assess your risks. Our IT risk assessment guide walks through the steps.
- Keep tested backups, because availability loss is itself a breach. See our 3-2-1 backup rule guide.
- Secure your Microsoft 365 tenant, where much business email and data sits. Our Microsoft 365 security guide covers it.
The UK GDPR remains in force alongside the Data Protection Act 2018, and the ICO is the regulator you report to, so these duties apply to Aberdeen businesses as they do anywhere in the UK.
How Abersecure supports breach readiness
We provide IT support and cyber security for businesses in Aberdeen and Aberdeenshire, with Security by Default as our standard practice. Our managed cyber security service includes 24/7 endpoint monitoring, and we offer incident response, security awareness training and cyber risk assessment for SMEs. If you are unsure how your current setup would cope with the first 72 hours, talk to us through our site and we will explain how we can help.
FAQ
Do I have to report every data breach to the ICO?
No. You report only if the breach is likely to result in a risk to individuals’ rights and freedoms. You must assess this case by case and be able to justify the decision. Every breach must still be recorded internally.
Does the 72-hour deadline include weekends?
Yes. The period runs continuously, so a breach found on a Friday afternoon reaches its deadline on Monday afternoon. If you miss it, your notification must explain the reasons for the delay.
What happens after I submit a report to the ICO?
For an initial report, the ICO says it will contact you within seven calendar days with next steps and a case reference number. It uses the information to decide what should happen next and to understand the cause and the controls in place.
Do I need to tell customers or staff as well?
Only if the breach is likely to result in a high risk to them. In that case you must tell them directly, without undue delay and in plain language. Exceptions include data that was protected by measures such as encryption.
Does the UK still follow GDPR?
Yes. The UK GDPR applies alongside the Data Protection Act 2018, and the ICO is the regulator that receives breach reports from UK organisations.
