A calm, practical first-response plan for assessing a personal data breach, containing the incident, documenting decisions and meeting notification duties where required.
What counts as a personal data breach?
A personal data breach is a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It can involve a cyberattack, but it can also be a misdirected email, a lost device, an incorrect permission setting or a supplier incident.
The first question is not whether the incident was caused by a criminal. It is whether the confidentiality, integrity or availability of personal data has been affected and what that could mean for individuals.
The 72-hour rule
Where a breach is likely to result in a risk to people’s rights and freedoms, the controller must notify the ICO without undue delay and, where feasible, no later than 72 hours after becoming aware of it. If notification takes longer, the organisation should give reasons for the delay.
Not every breach is reportable. Every breach should nevertheless be assessed and documented, including the reasons for deciding that ICO notification is not required.
A first-response plan
1. Open an incident record immediately. Record when the issue was discovered, who reported it, what systems are involved and what is known so far. Preserve relevant evidence.
2. Contain the incident. Revoke exposed access, recover or isolate devices, correct permissions, stop an erroneous transmission where possible and involve the relevant technical or operational teams. Containment should not destroy evidence.
3. Establish the facts. Identify the categories and approximate volume of personal data, the people affected, the likely recipients, the duration and whether the data was encrypted or otherwise protected.
4. Assess risk to individuals. Consider possible physical, material and non-material harm, including loss of control, identity theft, fraud, discrimination, distress or reputational damage. Assess likelihood and severity case by case.
5. Decide on notification. Escalate the risk assessment to the person responsible for data protection. If notification to the ICO is required, submit it within the applicable timeframe even if some details are still being established; follow up with additional information when available.
6. Consider communicating with individuals. Where the breach is likely to result in a high risk, affected people may need clear information about what happened, likely consequences, protective steps and a contact point for further help.
7. Document and learn. Record the facts, effects, remedial action and the notification decision. Investigate root causes and address process, training or technical weaknesses so that the same incident is less likely to recur.
What processors should do
If a processor experiences a breach affecting a controller’s personal data, it must inform the controller without undue delay. Contracts should make the reporting route, required information and escalation contacts clear before an incident occurs.
Build readiness before an incident
- Maintain a current incident-response plan and call tree.
- Keep a breach log and risk-assessment template ready.
- Test reporting routes with short tabletop exercises.
- Make it easy for staff to report mistakes and near misses quickly.
- Review supplier contracts for breach-notification timing and responsibilities.
This article is general information, not legal advice. Reporting decisions are fact-specific and should be checked against the latest ICO guidance.
Further reading
- ICO: Personal data breaches: a guide
- ICO: 72 hours - how to respond to a personal data breach