Artifact GuideUKBreach Workflow

UK GDPR Breach Workflow

Breach Workflow decisions under the UK GDPR should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

This guide converts requirements into implementation-ready ownership, evidence, and review decisions. It is practical guidance, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page maps Breach Workflow into a containment, assessment, reporting, and documentation path so legal, privacy, security, and compliance teams can execute consistently.

Section 1

How should a Breach Workflow run under the UK GDPR?

Run the workflow as UK data-protection breach triage: contain the incident, log what happened, assess whether it is likely to risk people's rights and freedoms, decide whether to notify the ICO within 72 hours, and record the reasoning and follow-up action.

Contain the incident first, then capture the facts, affected systems, and the likely impact.
Decide whether the breach is reportable by checking whether it is unlikely to result in a risk to people's rights and freedoms.
If it is reportable, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.
If the breach is likely to result in a high risk to people, plan a separate communication to affected individuals without undue delay.
Document the facts, effects, remedial action, the reportability decision, and the reason for any delay or exception.
Keep a plain-language output that support, product, legal, security, and compliance teams can all understand.

Sources for this answer

ICO personal data breaches: a guide

ICO guidance supports the breach workflow triage, reporting threshold, 72-hour notification, individual-notice, and breach-record steps.

ICO 72 hours: how to respond to a personal data breach

ICO first-response guidance supports starting the timer, logging facts, containing the breach, assessing risk, and reporting early.

ICO self-assessment for data breaches

ICO self-assessment guidance supports the workflow decision on whether a breach is likely to risk people's rights and freedoms.

Section 2

What fields should the Breach Workflow template capture?

A useful template captures role, purpose, lawful basis, data category, individual group, DPIA/transfer/breach trigger, owner, evidence link, and ICO escalation note.

Source URL and source quote.
Entity, product, service, system, data category, and user group.
Decision result, control action, owner, reviewer, due date, and escalation reason.
Evidence attachment, approval note, exception note, and review cadence.

Sources for this answer

ICO personal data breaches: a guide

ICO guidance supports the breach workflow triage, reporting threshold, 72-hour notification, individual-notice, and breach-record steps.

ICO 72 hours: how to respond to a personal data breach

ICO first-response guidance supports starting the timer, logging facts, containing the breach, assessing risk, and reporting early.

ICO self-assessment for data breaches

ICO self-assessment guidance supports the workflow decision on whether a breach is likely to risk people's rights and freedoms.

Section 3

How should teams review and improve the Breach Workflow?

Review the workflow after ICO guidance, adequacy or transfer updates, vendor changes, new profiling, new child-user journeys, incidents, DSAR trends, or complaints.

Track recurring exception categories and update intake questions.
Remove fields that never affect the decision.
Add fields when reviews show missing source evidence or unclear ownership.
Confirm the published guidance and internal breach record use the same source-linked decision, owner, deadline, and evidence fields.

Sources for this answer

ICO personal data breaches: a guide

ICO guidance supports the breach workflow triage, reporting threshold, 72-hour notification, individual-notice, and breach-record steps.

ICO 72 hours: how to respond to a personal data breach

ICO first-response guidance supports starting the timer, logging facts, containing the breach, assessing risk, and reporting early.

ICO self-assessment for data breaches

ICO self-assessment guidance supports the workflow decision on whether a breach is likely to risk people's rights and freedoms.

Recommended next step

Turn UK GDPR Breach Workflow into assigned work

This UK GDPR guide turns Breach Workflow into owners, evidence requests, review checkpoints, and reusable operating records for implementation execution.

Assessment workflow

Open Assessment Autopilot for UK GDPR

Turn Breach Workflow into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK GDPR source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step