A personal data breach is not only a hacker. It is any security failure that leads to personal data being lost, destroyed, altered, or exposed to the wrong people. An email sent to the wrong client, a lost laptop, or a misconfigured folder all count.
The 72-hour rule
If a breach is likely to result in a risk to people’s rights and freedoms, you must notify the ICO without undue delay, and no later than 72 hours after becoming aware of it. The clock starts when you become aware, not when you finish investigating. If the risk to individuals is high, you also have to tell the affected people, in plain language, without undue delay.
Not every breach has to be reported. A one-off email to the wrong person that you can recall quickly, with no sensitive content, may not meet the threshold. But you have to make and record that judgement.
What to do, in order
- Contain it. Stop the bleeding: recall the email, revoke the access, take the system offline. Limit the spread first.
- Assess the risk. What data, how many people, how sensitive, what could happen to them. This decides whether you notify.
- Notify if required. Tell the ICO within 72 hours if the threshold is met, and tell affected individuals if the risk to them is high.
- Record it. Log every breach, even the ones you decide not to report, with what happened and why you judged it the way you did. The ICO can ask to see that log.
The part people forget
You must keep a record of all personal data breaches, reportable or not. That log is how you show you took it seriously and learned from it. Decide in advance who makes the call and where the log lives, because 72 hours is not the moment to be inventing a process. A short breach procedure, agreed while it is calm, is worth far more than it looks.