UK GDPR Breach Notification

Start by deciding whether the incident is a personal data breach and whether it is likely to result in a risk to individuals. If that threshold is met, the controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Run a separate high-risk test for affected individuals. If the breach is likely to result in a high risk to their rights and freedoms, tell them directly and without undue delay, while keeping a record of the breach and the risk assessment whether or not notification is required.

Ownership should sit with the incident lead who can coordinate privacy, security, legal, communications, and any processor or vendor evidence needed for the breach assessment.

Evidence should show the awareness timestamp, incident facts, affected data and people, containment steps, risk assessment, notification decision, ICO submission or non-reporting rationale, data-subject notice decision, and follow-up updates.

Check processor-to-controller reporting duties, PECR security-breach rules for communications providers, cross-border controller arrangements, vulnerable individuals, encrypted data, and whether phased reporting is needed because facts are incomplete.

Do not reuse transfer, DPIA, lawful-basis, or Article 30 evidence as a substitute for a breach record. The breach file needs its own timeline, risk test, notification decisions, and mitigation record.

Use a UK GDPR breach workflow that starts the 72-hour clock at awareness, captures facts quickly, assigns containment and risk-assessment owners, and records whether ICO and individual notifications are required.

The output should be a dated breach log, risk assessment, ICO report or non-reporting rationale, individual notice decision, mitigation actions, and follow-up review.