Run a breach process that can decide fast, notify the ICO in time, and preserve evidence.
Article 33 and 34 duties depend on risk analysis, not on whether the full story is known in the first few hours.
Structured answer sets in this page tree.
Cited legal and guidance references.
The ICO expects a controller to know when it became aware of a breach, whether the breach is notifiable, and what facts were sent in the initial and follow up reports.
A controller must notify the ICO without undue delay and where feasible within 72 hours of becoming aware of a notifiable personal data breach. If more time is needed, the report must explain the delay.
Assessment Autopilot can take UK GDPR Breach Notification from operationalizing response workflows and review cycles to a reusable workflow inside Sorena. Teams working on UK GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from UK GDPR Breach Notification and turn the guidance into owned tasks, evidence requests, and review checkpoints.
Review your current process, evidence gaps, and next steps for UK GDPR Breach Notification.
A processor must tell the controller about a breach without undue delay after becoming aware of it. That duty should appear in contracts, on call playbooks, and escalation paths.
Article 34 requires communication to affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms.