The Assurance DeskReporting is not the only duty. If the risk to people is high, UK law says you must also tell them directly and without undue delay. If a supplier that handles data for you had the breach, it must tell you without undue delay once it knows.
Some organisations handle a breach with their own team. Others bring in a data protection adviser, and a solicitor too if a legal claim looks likely. The guide to choosing a data protection adviser covers the wider questions.
The first steps after a breach
- Contain it Stop it going further, and note when you found out.
- Judge the risk Ask how likely and how serious the harm to people could be.
- Report it if needed If people are likely to be at risk, tell the UK data protection regulator without undue delay, within 72 hours where feasible.
- Tell the people affected Do this directly if the risk to them is high.
- Record it Log every breach, reported or not, with what you did.
Some personal data breaches will not lead to risks beyond possible inconvenience to those who need the data to do their job.
What to do after a personal data breach: the first steps
- Write down the date and time you found out, and keep every log, email and screenshot from then on.
- Contain the breach, then judge the risk to people. Write down your reasoning, whichever way you decide.
- If you must report, do it without undue delay and, where feasible, within 72 hours. You can send the details in stages.
- Tell the people affected directly if the risk to them is high, with advice on how to protect themselves.
- Record every breach, reported or not, with the facts, the effects and what you did.
- If you bring in outside help, read what your current contract covers first, and agree any extra fee in writing.
Reporting a data breach: common questions
Do we have to report every breach?
No. You report a breach when it is likely to put people's rights and freedoms at risk. You must still keep a record of every breach, with the facts, its effects and what you did about it.
What if we miss the 72 hours?
If you miss the 72 hours, report the breach anyway. A late report must give the reasons for the delay.
Do we need a lawyer or a consultant to answer the regulator?
You do not always need a lawyer or a consultant to answer the regulator. Some organisations reply with their own team. A data protection consultant can help you judge the risk, write the report and reply. A solicitor can help if a fine or a legal claim looks likely.
We are in the US. Do the same rules apply?
In the US, different rules apply. Every US state has its own law on telling people about a breach of personal information. Check which laws cover the people affected, including any outside the US.
Sources
- ICO, personal data breaches: a guide, checked 29 September 2026
- UK GDPR Article 33, checked 2 October 2026
- S.I. 2026/1015, checked 2 October 2026
- the ICO, checked 2 October 2026
- FTC, checked 29 September 2026