How to Report a Data Breach

When a data breach is suspected, it must be assessed promptly to determine if it involves personal data. If confirmed, organisations must:

1. Report the breach internally to the DPO or the responsible person.

2. Assess whether the breach poses risks to individuals’ rights and freedoms.

3. Use the ICO’s reporting tool to submit details within 72 hours of becoming aware.

4. Notify affected individuals if there is a high risk of harm.

Failure to report within the timeframe can result in fines and enforcement action. Effective breach management policies and staff awareness training are critical components of compliance.