What should teams do about 72-hour Breach Reporting under the UK GDPR?
Teams should run 72-hour breach reporting as an incident workflow: record when the organisation became aware of a personal data breach, assess whether it is notifiable to the ICO, submit the report without undue delay and where feasible within 72 hours, and keep any delayed or phased-reporting rationale with the incident record.
Start with breach facts, affected personal data, likely risk to individuals, containment steps, controller/processor role, ICO notification decision, and whether affected individuals also need to be told.
- Record the awareness timestamp before drafting controls or communications.
- Assess likelihood and severity of risk to individuals and document the notification decision.
- Route uncertain or high-risk cases to privacy, legal, security, and incident-response owners before the 72-hour window closes.
ICO breach-reporting guidance supports the operational trigger, ICO notification route, and 72-hour handling expectation for UK GDPR incidents.
ICO guidance explains that notifiable breaches must be reported within 72 hours of awareness and that incomplete information can be supplemented.
Article 33 is the binding UK GDPR source for controller notification to the supervisory authority and the 72-hour clock.
Article 34 supports the separate decision on whether affected individuals must be told when a breach is likely to result in high risk.