When and How to Report a Personal Data Breach

When a personal data breach occurs in your UK business, you must assess whether it meets the thresholds for reporting to the Information Commissioner’s Office (ICO) and document your decision-making process. The 72-hour notification rule applies only if the breach is likely to result in a risk to people’s rights and freedoms.

This guide explains the key obligations for ICO notification, the importance of internal record-keeping, and provides practical steps and examples to help early-stage founders and e-commerce sellers handle breaches effectively while meeting UK requirements.

Understanding What Counts as a Personal Data Breach

A personal data breach is any incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. For e-commerce sellers this could include customer names, addresses, payment details or order history being exposed. Not every incident is a reportable breach; you must evaluate the nature, sensitivity and volume of the data involved as well as the potential impact on the individuals affected.

Common examples include an email sent to the wrong customer containing order details, a lost laptop with unencrypted customer files, or a cyber-attack that compromises your website database. The key is to determine quickly whether the breach creates any risk to individuals’ rights and freedoms, such as financial loss, identity theft or damage to reputation.

ICO Notification Thresholds and the 72-Hour Rule

You are required to notify the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach if it is likely to result in a risk to the rights and freedoms of individuals. The 72-hour period begins when your business first becomes aware of the breach, not when it actually occurred. If you cannot notify within this timeframe you must provide reasons for the delay.

Thresholds change and the ICO provides guidance on GOV.UK to help you assess risk. Low-risk incidents, such as a secure backup being used to restore data with no unauthorised access, may not require notification. High-risk examples include loss of unencrypted customer payment information that could lead to fraud. Always document your risk assessment even if you decide not to notify.

Internal Record-Keeping Obligations

Regardless of whether you notify the ICO, you must maintain an internal record of every personal data breach. This record must include the facts relating to the breach, its effects, and the remedial action taken. Records should be kept in a way that allows the ICO to verify your compliance if requested.

Practical steps include creating a simple breach log template with fields for date and time of discovery, description of the breach, types and approximate number of individuals and records affected, likely consequences, and measures taken to address the breach and prevent recurrence. Store these records securely and retain them for at least six years to align with typical limitation periods for related claims.

Step-by-Step Process for Handling a Suspected Breach

Stop the breach where possible – for example, revoke compromised access credentials or take the affected system offline.
Assemble a small response team including anyone responsible for data protection, IT and senior management.
Gather the facts: what data was involved, how many people were affected, how the breach happened and whether any data left your control.
Assess the risk to individuals by considering the sensitivity of the data, the type of breach, and the potential harm such as identity theft or financial loss.
Decide on notification: if the risk assessment indicates a likely risk to rights and freedoms, prepare to notify the ICO within 72 hours.
Notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms, providing clear information on what happened and what they should do to protect themselves.
Document every step and decision in your internal breach log.

These steps help ensure you act methodically rather than reactively, reducing the chance of further breaches and supporting your compliance position.

Communicating with Customers and Other Parties

When a breach requires notification to individuals, the communication must be clear, transparent and specific. Explain what happened, the data involved, the potential consequences and the steps you have taken or recommend they take. Avoid technical jargon that could confuse recipients.

For e-commerce businesses this might mean emailing customers whose payment details were exposed and advising them to monitor their bank statements and consider changing passwords. If the breach also affects suppliers or partners who provided data, consider whether you need to inform them under your contractual arrangements. Keep records of all communications sent.

Learning from the Breach and Improving Processes

After containing and reporting a breach, conduct a review to identify root causes and update policies, training or technical controls. For example, if the breach occurred because staff sent customer data by unencrypted email, introduce a policy requiring secure file-sharing tools and provide refresher training.

Regularly test your incident response plan through walkthroughs or simulations. This helps ensure that when a real breach occurs your team knows who is responsible for each task and can meet the 72-hour notification window where required. Updating contracts with processors to include clearer breach-notification clauses can also strengthen your position.

Seeking Support for Early-Stage UK Businesses

Early-stage founders and e-commerce sellers often operate with limited resources, making it sensible to build basic data protection processes from the start. Free resources on GOV.UK and the ICO website provide templates and checklists that can be adapted to your needs without significant cost.

Organisations such as Loomworks in West Yorkshire offer selected founders free desks, a registered address and operator mentoring with no fees or equity taken, providing a supportive environment to develop these foundational systems alongside business growth.

Frequently asked questions

Do I have to notify the ICO for every data breach?

No. You only need to notify the ICO if the breach is likely to result in a risk to the rights and freedoms of individuals. Low-risk incidents still require an internal record but not external notification. Always document your risk assessment to demonstrate your reasoning.

What happens if I miss the 72-hour notification deadline?

You must still notify the ICO as soon as possible and explain why the notification is late. The regulator takes the timeliness of reporting into account when assessing compliance. Prompt internal detection and escalation processes help avoid missing this window.

How detailed should my internal breach records be?

Records must include the facts of the breach, its effects, remedial actions taken and your risk assessment. A simple template capturing date, description, number of people affected, consequences and actions is usually sufficient. Retain records securely for a suitable period.

Should I tell customers about every breach?

Only notify individuals if the breach is likely to result in a high risk to their rights and freedoms. When you do notify, provide clear, plain-language information about the breach and practical steps they can take to protect themselves.

Can using a cloud platform reduce my breach reporting obligations?

Using a reputable cloud provider does not remove your legal responsibilities as the data controller. You must still assess any breach, maintain records and notify the ICO where required. Ensure your contract with the provider includes clear breach-notification terms.