Failure to notify the ICO: the 72-hour data breach rule explained

Discovering a data breach is stressful enough. Discovering, weeks later, that you were meant to report it to the regulator makes it much worse. The rules are simpler than most people think, and they’re easier to follow if you know them before you need them.

The short answer: if a personal data breach is likely to put people at risk, you must report it to the ICO within 72 hours of becoming aware of it. If the risk is high, you must tell the affected people too. (Since 30 September 2026 the regulator is legally the Information Commission, but it still calls itself the ICO and the reporting service is still at ico.org.uk.)

What counts as a personal data breach?

A personal data breach is any security incident that affects personal data. It isn’t only hackers. It includes:

• An email containing client details goes to the wrong person.
• A laptop or phone that wasn’t encrypted is lost or stolen.
• A ransomware attack locks or steals files.
• A staff account is taken over through a phishing email.
• Someone looks at records they have no right to see.

When do you have to report it?

Ask one question: is this likely to result in a risk to people? Think about financial loss, identity theft, fraud, discrimination, damage to reputation or distress.

Situation	Report to the ICO?	Tell the people affected?
Unlikely to cause any risk (e.g. an encrypted laptop lost)	No, but record it	No
Likely to cause a risk	Yes, within 72 hours	Only if the risk is high
Likely to cause a high risk (e.g. bank details or health data exposed)	Yes, within 72 hours	Yes, without undue delay

The 72 hours run from when you become aware of the breach, and they include weekends. If you don’t have the full picture yet, report what you know and follow up.

What happens if you don’t notify?

Failing to report a reportable breach is a breach of UK GDPR in its own right. The ICO can fine up to £8.7 million or 2% of global annual turnover for it (ICO), whichever is higher, on top of anything for the breach itself.

In practice, for most small businesses the bigger damage is elsewhere: clients finding out from someone else, and insurers questioning a claim. In our experience, what turns a breach into a serious matter is a pattern: no records and no response plan.

What to do in the first hour

1. Contain it. Disconnect affected devices and reset compromised passwords.
2. Call your IT provider and your cyber insurer. Many policies require prompt notification. Don’t delete anything until they’ve advised you.
3. Start a record. What happened, when you found out, what data and how many people, and what you’ve done. You need this whether you report or not.
4. Assess the risk to people, and decide whether to report. If in doubt, take advice quickly. The 72 hours are already running.
5. Report, using the ICO’s online breach form or helpline (0303 123 1113).

A written incident response plan makes all of this calmer and faster.

What has changed since we first wrote this

• New legislation. The Data (Use and Access) Act 2025 became law in June 2025, and the ICO says all its provisions affecting data protection law and PECR (the marketing and cookie rules) are now in force (ICO). On 30 September 2026 the Information Commission took over the regulator’s work, with the same role, responsibilities and powers (GOV.UK). The 72-hour rule for personal data breaches hasn’t changed.
• Higher fees. The ICO’s annual data protection fee rose in February 2025: £52 for micro organisations, £78 for small and medium ones, £3,763 for large ones.
• Faster attacks. The NCSC expects AI to make cyber attacks more frequent and more effective (NCSC, May 2025). In our experience, breaches now involve a taken-over email account far more often than lost paperwork.
• Prevention is cheaper than reporting. Encryption on laptops and multi-factor authentication turn many would-be breaches into non-events. See what is encryption and phishing email training.

This article is general guidance, not legal advice. For a specific breach, check the ICO’s guidance or take legal advice.

Where an AI agent helps

Staying on top of data protection obligations is easier with help:

• The AI Compliance Agent ↗ keeps track of your GDPR obligations and reminds you what’s due.

See all our agents in the solutions library on jerait.ai ↗, or find the right agent for your business on jerait.ai ↗.

The catch: the AI an agent runs on is paid for by use. With Jera IT support, your first agent is built, supported and maintained free; we give you a rough idea of the usage cost before you commit, and a real figure from the trial.

How Jera can help

When something goes wrong, we help businesses across Edinburgh, Glasgow and Aberdeenshire contain it and gather the facts you need to report; see our cyber security services. If you think you’ve had a breach now, call your IT provider first. If that’s us, ring your local office, or our central number on 0333 358 7888 (08:00 to 17:00, Monday to Friday). Out of hours, contain it and start the record now, and if the breach is reportable, use the ICO’s online form rather than wait: the 72 hours keep running.