A GDPR data breach can expose a business to regulatory action, financial losses and reputational damage. From accidentally emailing customer information to a cyberattack that exposes employee records, personal data breaches can affect organisations of every size across the UK. Knowing how to respond quickly is essential for protecting individuals and meeting data protection obligations.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, organisations must assess personal data breaches, keep appropriate records and report certain incidents to the Information Commissioner’s Office (ICO). In some circumstances, they must also notify the affected individuals.
This guide explains what counts as a GDPR data breach, when businesses need to report an incident, and the practical steps they should take to respond.
What Is a GDPR Data Breach?
A GDPR data breach occurs when a security incident leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Personal data is information that identifies, or can be used to identify, an individual. Examples include names, addresses, email addresses, telephone numbers, financial information, employee records and customer account details.
A data breach does not necessarily involve a hacker. It can happen because of human error, inadequate security procedures, lost equipment or technical failures.
Examples of a GDPR data breach include:
Businesses should treat suspected incidents seriously and investigate them promptly to establish what happened and whether personal data was affected.
What Should a Business Do After a GDPR Data Breach?
When a business discovers a potential data breach, it should respond immediately. A clear incident response process can help limit harm, preserve evidence and support compliance with UK data protection requirements.
Identify and Contain the Breach
The first priority is to establish what happened and prevent the incident from becoming worse.
Depending on the circumstances, the business may need to disable compromised accounts, reset passwords, restrict access to affected systems, isolate infected devices or contact the unintended recipient of information sent by mistake.
For a cyberattack, involve the appropriate IT or cybersecurity specialists. Preserve relevant logs, emails and other evidence rather than deleting information that could help establish the cause and extent of the incident.
Assess the Personal Data Involved
Investigate the type of personal data affected, how many people may be involved and whether the information could be misused.
Consider whether the incident involves sensitive information, financial details, login credentials, children’s data or information that could expose individuals to identity theft, fraud, discrimination or distress.
The purpose of this assessment is to understand the potential impact on people’s rights and freedoms and determine what action is required.
Notify the Appropriate People Internally
Inform the person or team responsible for managing data protection incidents, such as the data protection officer, privacy lead, senior management or designated incident response team.
Employees should know how to report suspected breaches without delay. Organisations should not wait until every detail has been confirmed before escalating a credible concern.
If a third-party processor discovers a personal data breach involving information it handles for a business, it must notify the relevant controller without undue delay under the UK GDPR.
Determine Whether the Breach Must Be Reported
Not every personal data breach must be reported to the ICO. Businesses need to assess the likelihood of a risk to individuals’ rights and freedoms.
If a breach is likely to result in such a risk, the organisation must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.
If the breach is unlikely to result in a risk to individuals’ rights and freedoms, notification to the ICO is not required under this reporting rule. However, the business must still document the breach.
The decision should be based on a reasonable assessment of the circumstances and recorded for future reference.
Inform Affected Individuals When Required
If a breach is likely to result in a high risk to individuals’ rights and freedoms, the business must communicate the breach to the affected individuals without undue delay, subject to applicable legal exceptions.
The communication should explain what happened, the likely consequences, the measures taken to address the incident and practical steps individuals can take to protect themselves.
For example, if login credentials have been exposed, individuals may need to change their passwords and watch for suspicious account activity.
Record the Incident and Review the Response
Businesses must document personal data breaches, including incidents that do not need to be reported to the ICO.
Records should explain the nature of the breach, its effects, the actions taken and the reasons behind the decision to notify or not notify the ICO.
After containing the incident, review what went wrong and introduce improvements. These may include stronger access controls, additional staff training, improved backup procedures or changes to the organisation’s incident response plan.
The ICO provides guidance on personal data breaches and how to respond.
Does a GDPR Data Breach Have to Be Reported Within 72 Hours?
The UK GDPR requires organisations to report a notifiable personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
The deadline is not a reason to postpone reporting while waiting for a complete investigation. Where information is incomplete, organisations should provide the information available and supply further details in phases without undue further delay.
If the ICO is notified after the 72-hour period, the organisation must explain the reasons for the delay.
Businesses should therefore have an internal process that allows staff to escalate incidents quickly, assess risks and make reporting decisions without unnecessary delays.
It is important to distinguish between discovering a possible security incident and becoming aware that a personal data breach has occurred. Organisations should assess the facts promptly and should not deliberately delay acknowledging a breach.
For further information, read the ICO’s official guidance on how to respond to a personal data breach within 72 hours.
What Information Should Be Included in an ICO Data Breach Report?
When reporting a notifiable breach, a business should provide the ICO with as much accurate information as it can. This normally includes:
If the business cannot provide all the information at once, it can submit additional details in phases without undue further delay.
Organisations should maintain a clear timeline of the incident, including when it was discovered, when it was escalated, what decisions were made and which containment measures were implemented.
Businesses can find reporting guidance and access the reporting process through the ICO’s Report a breach page.
What Happens If a Business Fails to Report a GDPR Data Breach?
Failing to meet data protection obligations can lead to regulatory scrutiny and enforcement action. The consequences depend on the nature of the incident, the organisation’s response, the potential harm to individuals and the applicable legal requirements.
Possible consequences include:
Not every data breach results in a fine. Organisations should nevertheless take every incident seriously, comply with their reporting duties and demonstrate that they have acted responsibly.
Build Your GDPR Knowledge
Learn how to protect personal data, understand UK GDPR responsibilities and respond to data breaches with the UK General Data Protection Regulation (GDPR) course.
How Can UK Businesses Prevent GDPR Data Breaches?
Although not every incident can be prevented, effective security controls and staff awareness can reduce the likelihood and impact of a breach.
Train Employees in Data Protection
Staff should understand how to handle personal information securely, recognise suspicious emails, verify recipients before sending sensitive data and report mistakes immediately.
Regular GDPR awareness training can help employees understand their responsibilities and recognise common risks.
Control Access to Personal Data
Give employees access only to the information they need for their roles. Use strong authentication, secure password practices and multi-factor authentication where appropriate.
Review access permissions regularly, particularly when employees change roles or leave the organisation.
Encrypt and Secure Devices
Protect laptops, mobile devices and removable storage that contain personal information. Use encryption where appropriate, maintain security updates and establish procedures for reporting lost or stolen equipment.
Maintain Backups and Security Monitoring
Regularly back up important information and test whether it can be restored. Monitor systems for suspicious activity and ensure that security incidents can be escalated to the appropriate people.
Review Suppliers and Data Processors
Check how third-party providers store, access and protect personal data. Contracts with processors should include the required data protection terms, including arrangements for reporting personal data breaches.
Establish a Written Incident Response Plan
A documented response plan should identify who investigates incidents, who assesses risk, who decides whether to notify the ICO and who communicates with affected individuals.
Review the plan periodically and test it through realistic exercises so that employees know what to do when an incident occurs.
Who Is Responsible for Managing a GDPR Data Breach?
Responsibility depends on the organisation’s role and the circumstances of the breach.
A data controller determines the purposes and means of processing personal data. It is generally responsible for deciding whether a breach must be reported to the ICO and whether affected individuals must be informed.
A data processor processes personal data on behalf of a controller. If it becomes aware of a personal data breach involving that data, it must notify the controller without undue delay.
A data protection officer, where appointed, may advise on compliance, support the assessment and help coordinate the response. IT, cybersecurity, legal and senior management teams may also have important roles.
Even when a business uses an external IT provider or cloud service, it should understand its own responsibilities and ensure that appropriate procedures and contractual arrangements are in place.
Why GDPR Training Matters for UK Businesses
Employees play a significant role in protecting personal information. A simple mistake, such as sending a spreadsheet to the wrong recipient or sharing a password, can expose an organisation to serious risks.
GDPR training helps employees understand data protection principles, recognise personal data breaches and follow appropriate reporting procedures. It can also help managers build consistent practices for handling information across teams.
Training should be relevant to employees’ responsibilities and supported by clear policies, appropriate security controls and regular reviews. A course alone does not guarantee compliance, but it can form part of a broader data protection programme.
Frequently Asked Questions
What is a GDPR data breach?
A GDPR data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It can happen through cyberattacks, human error, lost devices or inadequate security controls.
Do all GDPR data breaches have to be reported to the ICO?
No. A business must notify the ICO when a personal data breach is likely to result in a risk to individuals’ rights and freedoms. Regardless of whether notification is required, the organisation must document the breach.
How quickly must a business report a GDPR data breach?
A notifiable breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it. If the report is late, the organisation must explain the delay.
When must a business inform people affected by a data breach?
A business must inform affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, subject to applicable legal exceptions. The communication should explain the incident, likely consequences and relevant protective steps.
Can GDPR training help prevent data breaches?
Yes. GDPR training can help employees recognise risks, handle personal information securely and report incidents promptly. It should be combined with suitable technical safeguards, clear policies and effective incident response procedures.
Build Your GDPR Knowledge
Learn how to protect personal data, understand UK GDPR responsibilities and respond to data breaches with the UK General Data Protection Regulation (GDPR) course.
Final Thoughts
A GDPR data breach can happen through human error, lost equipment, cyberattacks or weaknesses in an organisation’s security procedures. What matters is how quickly and responsibly the business responds.
UK organisations should contain incidents, assess the risks to individuals, document what happened and report qualifying breaches to the ICO without undue delay and, where feasible, within 72 hours. They must also inform affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, subject to applicable exceptions.
Regular staff training, effective security controls and a clear incident response plan can help businesses reduce risks and handle incidents more confidently. By making data protection part of everyday working practices, organisations can better protect personal information and maintain trust.
