Last reviewed 10 September 2026
A misdirected email with a client list attached, a compromised mailbox, a lost laptop or a ransomware incident all raise the same first questions: what personal data is involved, who could access it and what harm could follow.
Under the UK data protection regime, organisations must handle personal data securely and must deal with personal data breaches through a defined process that includes assessment, recording and, in some cases, notification to the Information Commissioner's Office and to the individuals affected. The reporting timescales are short.
This guide is general information about breach response. It is not legal advice, and because the timescales are tight you should take advice on your own circumstances as soon as an incident is suspected.
Contain it before you analyse it
Immediate steps commonly include resetting credentials and revoking sessions, isolating affected systems or accounts, recalling or asking for deletion of a misdirected message, disabling a compromised integration and preserving logs before they roll over.
Preserve evidence while you contain. Log retention windows are often short, and losing the audit trail makes both the assessment and any later insurance or regulatory discussion much harder.
Establish the facts
Work out what categories of personal data are involved, how many individuals are affected, whether any of it is sensitive, whether the data was encrypted, who obtained access and whether the data has been used.
Record what is known and what is still unknown, with times. An incident log started in the first hour is worth far more than a report written afterwards, and it also protects the people handling the incident.
Assess the risk to individuals
The assessment focuses on the risk to the rights and freedoms of the people whose data is involved, considering matters such as identity fraud, financial loss, reputational damage or distress, and the vulnerability of those affected.
That assessment drives everything else, including whether the incident is reportable and whether the individuals themselves need to be told. It should be documented with the reasoning, not just the conclusion.
Recording and reporting
All personal data breaches must be recorded internally, including those that are not reported, together with the effects, the reasoning and the remedial action taken. That record is one of the first things a regulator asks for.
Where the risk assessment requires it, the incident is notified to the Information Commissioner's Office within the short statutory timescale, and where the risk to individuals is high they are informed as well. Where you are processing data on behalf of another organisation, your contract will normally require you to notify them without undue delay.
Talking to customers and staff
Communications should be clear about what happened, what data was involved, what the organisation has done and what the individual can do. Avoid minimising language, and do not promise more certainty than the investigation supports.
Brief whoever answers the phone. Inconsistent responses cause more reputational damage than the incident, and a short written holding line prevents well meant guesswork.
Afterwards: fix the cause
Complete a short post incident review that identifies the root cause and the changes made, whether that is multi factor authentication, restricted bulk export, external email warnings, better leaver processes or supplier due diligence.
Review the surrounding paperwork too: the record of processing, retention periods, privacy information and the data processing terms with suppliers. Incidents frequently expose that data was held longer or shared more widely than anyone intended.
Key points
- Contain and preserve evidence at the same time.
- Record the facts and the timeline as you go.
- The assessment turns on the risk to affected individuals.
- Every personal data breach is recorded internally, whether or not it is reported.
- Reporting timescales are short, so take advice early.
- Close the loop with a root cause fix and a documentation review.
Frequently asked questions
- Does every data breach have to be reported to the ICO?
- No. Reporting depends on the risk the breach poses to the rights and freedoms of the individuals concerned. All breaches must still be recorded internally with the reasoning for the decision taken.
- How quickly do we have to report?
- The statutory timescale for notifying the regulator is short and runs from awareness of the breach, so the assessment needs to begin immediately. Because the deadline is tight, advice should be taken as soon as an incident is suspected.
- Do we have to tell the people affected?
- Where the breach is likely to result in a high risk to the individuals, they must be informed without undue delay and in clear language. Where the risk is lower, notification may not be required, and the reasoning should be recorded.
- A supplier caused the breach. Is that still our problem?
- If you decide how and why the personal data is processed, the responsibility largely remains with your organisation. Your contract with the supplier should require prompt notification and cooperation, which is why those terms matter.
- Is a misdirected email really a breach?
- It can be. Sending personal data to the wrong recipient is one of the most commonly reported types of incident, and it is assessed in the same way as any other breach.