Personal data breach notification

How to detect, assess, record and, where required, notify a personal data breach under the UK GDPR. Two thresholds govern two separate duties: tell the Information Commission where the breach is likely to result in a risk to people's rights and freedoms (Art 33), and tell the people affected only where the risk is high (Art 34). Conflating the two is the commonest breach-response error. Public electronic communications providers also have a parallel PECR duty.

Applies to

Every controller under the UK GDPR, and processors (who report to the controller). Providers of public electronic communications services additionally follow PECR reg 5A (step 9).

Instruments

UK GDPR, DPA 2018, PECR

Steps

9 steps, with a deadline calculator, including a step that carries a criminal offence.

Deadline calculator

Mechanics

Steps

1. Detect and record

   A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art 4(12)). Availability and integrity count, not only confidentiality: ransomware and accidental deletion with no backup are breaches. Log every suspected breach in the internal register the moment it is identified, before you know whether it is notifiable.

   See UK GDPR

2. Fix the point of awareness

   The 72-hour clock runs from when the controller becomes aware: when it has a reasonable degree of certainty that a security incident has compromised personal data, not from the incident itself. A short investigation to confirm is fine; indefinite deferral is not. Record the moment of awareness and the reasoning.

   See UK GDPR

3. Apply the risk test for the regulator

   Notify unless the breach is unlikely to result in a risk to people's rights and freedoms. "Risk", not "high risk": the bar is low. Weigh the nature, sensitivity and volume of the data, how easily people can be identified, and what could happen to them. In genuine doubt, notifying is usually the defensible course.

   See UK GDPR

   Two thresholds, two duties. A breach can require notification to the regulator but not to individuals. Treating them as one test is the commonest and most penalised mistake.

4. Notify the Information Commission within 72 hours

   Report through the regulator's online personal data breach report, or its helpline for urgent matters. Include at least: the nature of the breach, with categories and approximate numbers of people and records where possible; the DPO or other contact point; the likely consequences; and the measures taken or proposed (Art 33(3)). A late notification must give reasons for the delay. Keep the reference number in the register entry.

   See UK GDPR

5. Apply the high-risk test for individuals

   Tell affected people without undue delay where the breach is likely to result in a high risk to them, in clear and plain language, with the Art 33(3)(b) to (d) information. Not required where the data was protected so as to be unintelligible (for example strong encryption), where later measures mean the high risk is no longer likely, or where it would involve disproportionate effort, in which case a public communication or equally effective measure is used instead (Art 34(3)).

   See UK GDPR

6. Notify in phases if you must

   Where you cannot give everything at once, give what you have within 72 hours and follow up without further undue delay (Art 33(4)). An initial notification on time is better than a complete one that is late.

   See UK GDPR

7. Keep the register, and keep the records intact

   Document every breach, including those not notified: the facts, the effects and the remedial action, plus the reasoning for any decision not to notify (Art 33(5)). The register is the first thing the regulator will ask for. Preserve the underlying records too: "tidying up" after an incident destroys evidence, and if a subject access request has been made it can become a crime.

   See UK GDPR

   Criminal offence Where a subject access request has been made, altering, erasing, destroying or concealing information to prevent its disclosure to the requester is an offence under DPA 2018 s.173. Do not edit or delete records touched by the breach without advice.

8. Processors report to the controller

   A processor must tell the controller without undue delay after becoming aware of a breach (Art 33(2)). It has no direct duty to notify the regulator or individuals, but the controller's 72-hour clock depends on it, so build the trigger, timescale and content into the Art 28 contract.

   See UK GDPR

9. Communications providers, the PECR duty as well

   Providers of public electronic communications services also notify the regulator under PECR reg 5A: within 72 hours of becoming aware of the essential facts (the deadline was 24 hours until 2025-08-20, when DUAA s.111 aligned it with the UK GDPR). Subscribers or users must be told without unnecessary delay where the breach is likely to adversely affect their personal data or privacy, unless the data was made unintelligible. This runs alongside the UK GDPR duties, not instead of them.

   See PECR

   PECR penalties have matched the UK GDPR ceiling since 2026-02-05, so a missed PECR notification is no longer the cheaper failure.

Sources

• Primary Data Protection Act 2018, section 173 legislation.gov.uk
• Primary Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 5A legislation.gov.uk
• Regulator Security breaches (Guide to PECR) Information Commission (ICO guidance)
• Regulator Report a breach Information Commission (ICO)