Personal data breaches: what a small business must do in the first 72 hours

Most small business owners picture a data breach as a dramatic hack. In practice it is far more often something ordinary: an email sent to the wrong person, a laptop left on a train, a shared spreadsheet opened to the wrong people, or a staff login that a criminal has guessed or bought. All of these can count as a personal data breach under UK law, and some of them start a 72 hour clock. This guide sets out what the Information Commissioner's Office (ICO) actually says, so you know what to do before you ever need to.

What counts as a personal data breach

The ICO defines a personal data breach as a security incident that affects the confidentiality, integrity or availability of personal data. That is broader than theft or loss. It covers accidental and deliberate causes alike. The ICO's examples include:

• Unauthorised access to customer or staff records.
• Sending personal data to the wrong recipient.
• Lost or stolen devices holding personal data.
• Data being altered without permission.
• Losing access to data, where that significantly harms the people involved.

So a ransomware attack that locks your customer database, or a misdirected email with a client list attached, both need to be assessed as possible breaches.

The 72 hour rule

If a breach is likely to result in a risk to people's rights and freedoms, you must tell the ICO. The ICO says to do this without undue delay and no later than 72 hours after you become aware of it. The clock starts when you discover the breach, not when it happened.

Two points are easy to miss. First, you do not need every answer within 72 hours. The ICO's guidance says that if you lack full details, you should still notify, explain the gap and provide updates as soon as possible. Its reporting page encourages organisations to "report early" and "update later". Second, if you are late, you must give reasons for the delay.

When you do not need to report, and what to write down

If a breach is unlikely to result in a risk to individuals, you do not need to report it to the ICO. But you must document why you reached that decision. The ICO also expects you to record all breaches, whether or not you report them: the facts, the effects and what you did about it.

Judging risk means thinking about the possible harm to the people whose data it is. The ICO lists emotional distress, physical or material damage, identity theft, fraud and financial loss. You weigh both how serious the harm could be and how likely it is. A restaurant booking list sent to the wrong customer is a different matter from a file containing bank details or ID documents.

Telling the people affected

The bar for telling individuals is higher than the bar for telling the ICO. You must contact them directly and without undue delay if the breach is likely to cause a high risk to their rights and freedoms. The ICO says to use clear, plain language and to include:

• What happened.
• A contact point for questions.
• The likely consequences.
• What you have done, and what they can do, such as changing a password or watching for phishing and fraud.

The ICO can also compel you to inform individuals if it considers the risk to be high.

How to report

You report through the ICO's online form. The ICO says it takes about 30 minutes and that you cannot save a partly completed form and return to it, so gather your information first. You will need to say:

• What happened.
• When and how you found out.
• Who is affected or may be affected.
• What you are doing in response.
• Who the ICO should contact, and who else you have told.

You get a copy of what you submit. The ICO says it uses reports to decide next steps, understand the cause and assess your mitigations. It may use investigative or enforcement powers depending on the impact, and it expects you to review lessons learned afterwards. It also offers a self-assessment tool to help you decide whether a breach is reportable, and a short guide for small organisations and sole traders on the first 72 hours.

Other people you may need to tell

The ICO is not the only call. Its guidance says you are responsible for notifying all appropriate organisations, which can include your insurer, the police and your bank where there is a risk of financial loss. For suspected criminal activity the ICO points to Report Fraud, and to Police Scotland for organisations in Scotland.

If an attack is happening right now, the National Cyber Security Centre (NCSC) says to call 0300 123 2040. The line runs 24 hours a day, and live incidents are triaged by phone as a priority. For a significant cyber attack the NCSC recommends starting with a report at report.ncsc.gov.uk. The NCSC defines a cyber incident as unauthorised access, or attempted access, to an organisation's IT systems, whether from malicious causes such as ransomware and phishing or accidental ones such as fire, flood or theft.

What happens if you get it wrong

The ICO states that failing to notify a notifiable breach can lead to a fine of up to £8.7 million or 2% of global turnover, and fines can be combined with its other corrective powers. Those are the maximums, not what a typical small firm should expect, but they show why the notification duty is taken seriously. Note too that the ICO says this guidance is under review following the Data (Use and Access) Act 2025, so check the current wording on its site before you rely on any detail.

What to do this week

You cannot plan well in the middle of a crisis, so spend an hour on this now.

• Write a one page plan. Who decides whether something is a breach, who calls your IT provider, who contacts the ICO and who speaks to customers.
• Start a breach log. Even an empty spreadsheet with columns for date found, what happened, who is affected, risk decision and actions taken will save time.
• Save the key numbers. The NCSC incident line, your insurer, your IT supplier and your bank.
• Tell your team what to do. Staff should know to report a mistake or a lost device immediately, not to hide it. The 72 hours run from when the business becomes aware, so quick internal reporting matters.
• Ask your suppliers. The ICO says a processor must tell you without undue delay once it becomes aware of a breach. Check that your website host, payment provider and software suppliers know how to reach you.
• Review your access. Two step verification and removing logins for former staff reduce the chance of a breach in the first place.

If you would like help tightening up hosting, backups and access controls on your site and systems, our cloud and security team can talk it through with you.

The short version

A breach is any incident that harms the confidentiality, integrity or availability of personal data. Assess the risk quickly, write down your reasoning, and tell the ICO within 72 hours of becoming aware if there is likely to be a risk to individuals. Report early and update later, rather than waiting for a perfect picture. Tell the affected people directly if the risk is high. Having a simple plan in place before anything goes wrong is the most useful thing a small business can do.