UK GDPR 72-Hour Breach Reporting

A personal data breach is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It covers confidentiality, integrity, and availability failures, not only theft or disclosure.

The controller must notify the ICO unless the breach is unlikely to result in a risk to people's rights and freedoms. If notification is required, it must be made without undue delay and, where feasible, within 72 hours after the controller becomes aware. A processor must notify its controller without undue delay after becoming aware; Article 33 does not give processors their own 72-hour ICO deadline, although the contract may set a shorter escalation period.

The Article 33 report must, where possible, describe the nature of the breach, including the categories and approximate numbers of affected people and personal-data records; give the data protection officer's or other contact's details; describe likely consequences; and describe measures taken or proposed to address the breach and mitigate harm.

If all information is not available at once, provide it in phases without undue further delay. A report made after 72 hours must include reasons for the delay. Keep the submission, receipt, later updates, and decision trail with the incident record.

Article 34 requires the controller to communicate the breach to affected people without undue delay when it is likely to result in a high risk to their rights and freedoms. The communication must use clear, plain language and include the contact point, likely consequences, and measures taken or proposed, including mitigation.

Direct communication is not required if appropriate measures made the data unintelligible to unauthorised people, later measures ensure the high risk is no longer likely to materialise, or direct contact would involve disproportionate effort. In the last case, the controller must use a public communication or similarly effective measure. These exceptions must be assessed against the actual breach; encryption helps only if the keys and implementation remained secure.