Checklist for responding to a data breach

This checklist for responding to a data breach takes you through the steps you should take once you become aware of a personal data breach in your business (where personal data has been accidentally or illegally destroyed, lost, stolen or disclosed). This checklist includes the steps that you are legally required to take, depending on the circumstances of the breach. Failure to take the necessary steps after a personal data breach can result in very serious consequences, including significant fines.

Notice of a personal data breach (affected individuals)

This template Notice of a personal data breach (affected individuals) will allow you to produce a letter to send to any individuals who have been affected by a personal data breach in your business, where their personal data has been accidentally or illegally destroyed, lost or disclosed. You have a legal requirement to inform affected individuals where the breach carries a high risk to their rights and freedoms. In the most serious cases, failure to notify the affected individuals of a personal data breach can result in a significant fine. You can also purchase this document as part of the Data breach toolkit .
£10 + VAT
See all solutions
Data breaches
Explaining personal data breaches
Q1:What is a personal data breach?

A is a which leads to the accidental or illegal destruction, loss, alteration or unauthorised disclosure of . It also covers the situation where unauthorised access has been given to . The can be caused accidentally or deliberately.

A does not need to be caused by unauthorised electronic access, such as carried out by hackers or other unauthorised individuals that are often highlighted in the media. Nor does a data have to result in the data being permanently lost, damaged or otherwise made unavailable. Accidental disclosure of data that is in hard copy, or a temporary loss of data (or indeed loss of access to data), can also be a , if it is caused by a of .

All of the following situations are potential data :

  1. a device (eg a laptop or USB stick) containing a of customers' personal information is lost or stolen;

  2. your business's systems are accessed remotely by a hacker or other person without authority;

  3. a member of accidentally deletes data from your systems, the data cannot be retrieved and is not backed up;

  4. a power failure renders unavailable, and prevents you from accessing data;

  5. you leave a document, CD or USB stick on a train. Even if you recover it at a later date, a will have occurred for the period it was outside your control; and

  6. you send an email which contains customers' or ' personal information to the wrong address(es).

If a of occurs which puts the confidentiality, availability or integrity of you hold at risk, you should treat it in the first instance as a . The extent of your legal obligations when you become aware of such a potential data depends on the nature of the data affected and the potential risk posed to individuals.

For further guidance on what to do if you become aware or suspect that a data has occurred, see Q&A 2 and Checklist for responding to a data breach for a step-by-step checklist summarising the steps.

For guidance on steps you can take to minimise the risk of data occurring, see Secure data storage.


Obligations when a data breach occurs
Q2:What should I do if I become aware a personal data breach may have occurred?

When you become aware that a has occurred, you should take the following steps as soon as possible, and in most cases within 72 hours:

  1. take practical steps to contain the and recover any data (see Q&A 3);

  2. identify whether is affected by the . Your legal duty to provide notice of only relates to (see Q&A 4);

  3. determine whether you are a or a , as your obligations are different depending on which role your business carries out (see Q&A 5);

  4. assess the risk the potentially carries to individuals. The greater the risk, the more onerous the obligation to notify is (see Q&A 6);

  5. notify the of the , where you have determined that the carries some potential risk to individuals (see Q&A 7);

  6. notify the individuals whose data is affected, where the carries a high risk to the rights and freedoms of the individuals involved (see Q&A 11); and

  7. keep a written record of the (see Q&A 12).

For a single page checklist summarising the steps and process set out above, see Checklist for responding to a data breach. Use Data breach toolkit for a how-to guide and the documents you need to deal with a data .

In more serious cases, failure to make the necessary notification or keep a written record of such can result in a significant fine of up to £8.7 million or 2% of your global (whichever is higher, see Q&A 13). See Q&A 14 for more information.


Q3:What practical steps can I take to contain the breach and recover the personal data?

If you suspect a has occurred, your first priority should be containment and recovery. You should take any appropriate safeguarding measures immediately (eg remotely wiping or locking a lost or stolen device). It is important to respond quickly and effectively, to minimise any risk posed both to individuals who may be affected and to your business. You should make sure that your are fully trained to identify potential data and that they understand and follow your internal reporting procedure in line with your policies.

For further guidance on the steps you can take to help minimise the risk of occurring, and to limit the risks posed by such data , see Secure data storage. Use Data breach toolkit for a how-to guide and the documents you need to deal with a data .


Q4:How can I identify whether personal data is affected by the breach?

A is a of which affects . includes an individual's name, address, date of birth, contact details, or indeed any other information that would allow them to be identified. It also includes data generated by their own activity, such as (in the context of a website) their own contact lists or music playlists. For guidance on what constitutes a , see Q&A 1. If you believe a has occurred, you should progress with the steps set out in Q&A 2 (and see Checklist for responding to a data breach for a step-by-step checklist).

Your legal duties (eg to provide notice and keep a record) are more serious if the data affects . Conversely, if the data does not affect , you do not have a legal obligation to provide notice or keep a written record of it. However, it is often advisable to do so, particularly if you deem the sufficiently serious. Although the will not penalise you for failing to notify or record such a , it can nevertheless be good practice to make sure you are meeting your obligations to store data securely (for further guidance see The rules about storing data).


Q5:How do I know whether I am a data processor or a data controller?

In most cases, unless your business merely provides facilities for storage of data, your business is likely to be a . In certain circumstances your business may be both a and a . For further guidance on how to identify whether you are a or , see Data protection obligations.

If your business is a of the affected data, you should progress with the steps set out in Q&A 2 (and see Checklist for responding to a data breach for a step-by-step checklist).

If your busiis only a of the affected data, when you become aware of a you must notify the without undue delay. You should also review any contract you have with the , to see if you have any further obligations in the event of a data . Once you have done so, you will have met your legal obligations.


Q6:How do I assess the potential risk a personal data breach carries to individuals?

After becoming aware of a and determining that you control is affected, you should then assess the potential risk the carries to individuals. You can use the ICO's self-assessment for data breaches tool to establish the risk posed by the data .

To help in assessing the risk posed by a data , you should consider the factors set out in the first column of the table below. Low, medium and high risk examples are also set out alongside each below. These examples are included for guidance only, and all data must be considered objectively in the round when assessing risk.

Factors to consider

Low risk example

Medium risk example

High risk example

Type of

Temporary loss of access to (with no actual loss of the data itself)

Accidental deletion of some

Unauthorised access to personal information, login details and/or payment details

Nature and sensitivity of affected data

Data which is already widely available in the public domain

Data which is not widely available in the public domain but which is not highly confidential

Medical information, financial information or other confidential information

Volume of data

A small extract from a single page of a document

A folder containing relating to a number of individuals

All of the you hold

Ease of identification of individuals from data

Encrypted data which is fully anonymised (without an encryption key)

Personal information about an individual, without their name

An individual's name, address and payment details and/or login details

Severity of potential consequences for individuals

No likely risk of loss or damage to individuals

Inconvenience caused by loss of access to data (rather than loss of data itself), such as delay in payments or orders

Any risk of identity theft, fraud, physical harm, psychological distress, humiliation or damage to reputation

Number of individuals affected

No identifiable individuals affected

Several individuals affected (a very small proportion of your customers or )

Many individuals (and/or a large proportion of your customers or )

Any special characteristics of the individual(s) involved should also be taken into account. For example, where there has been a of data that relates to children or other vulnerable individuals, they may be placed at a greater risk of danger as a result. Similarly, any special characteristics of the should also be taken into consideration. For example, the nature of processed by a medical organisation will increase the risk to individuals whose data is .

Although the above table can assist in assessing risk, ultimately there is no science to the assessment and it is for you to determine. You must be able to show that you have taken steps to make an objective assessment. In most cases, unless a is a temporary loss of access to data which causes inconvenience but ultimately results in no loss or damage to , it is likely that there will be at least some potential risk to individuals.


Q7:When do I notify the ICO of the personal data breach?

If you decide that a potentially carries some risk to individuals, you should notify the without undue delay and, where feasible, within 72 hours of becoming aware of the . The 72-hour period begins when you become aware of the . The precise point when you become aware of a will depend on the particular circumstances, but as soon as you or one of your realises that a has occurred, the 72-hour clock will begin. This emphasises the importance of having internal processes for notifying a . For a template policy, see Personal data breach policy.

In certain limited circumstances, if you are unable to provide all of the information within the relevant 72 hour period, you can make a staged or delayed notification. However, you must give reasons for the delay. For instance, if your initial investigation uncovers a potential but a more detailed forensic examination is required to uncover the full extent of the , you should make a staged notification where you notify the within 72 hours of becoming aware of the potential with as much detail as possible. You should then provide further full disclosure once the detailed forensic examination is completed. Alternatively, a delayed notification may be appropriate where you suffer a series of consecutive similar (for instance a targeted series of attacks by multiple hackers). In such circumstances, if the series of attacks continues for a period of more than 72 hours, you could temporarily delay making the necessary notification to the to enable you to focus on your primary purpose of containing the . So long as the relate to the same type of and involve the same method, you can then report the series of as one once you have taken the necessary steps to contain the .

See Q&A 8 for guidance on how to notify the . If you determine a poses a high risk to individuals, you should also take steps to notify the individuals concerned as soon as possible. For guidance on how to make a notification to individuals concerned, see Q&A 11 and Notice of a personal data breach (affected individuals) for a template you can use.

On the other hand, if you determine that a is unlikely to result in a risk to individuals, you are not obliged to notify the or any individuals of the data . You should still keep a written record of such , though (see Q&A 12 and Template personal data breach register).


Q8:How do I notify the ICO of the personal data breach?

Unless you decide that the is unlikely to result in a risk to the rights and freedoms of individuals, you must notify the of the without undue delay and, where feasible, within 72 hours of becoming aware of it. You can report the either:

  1. by telephone, on 0303 123 1113; or

  2. by completing the 's online form, available on the 's Report a breach web page. Choose the ' or DPA 2018 ' option and click on 'Report a data security breach'. The 's form to report a can then be downloaded and filled in. The completed form can either be emailed to the (icocasework@.org., with ' notification' in the subject field) or sent by post to: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The online form option is appropriate where you have experienced a data but are confident that you have dealt with it appropriately, or you are still investigating the and will be able to provide further information later on. You can also use the online form to report outside the 's normal opening hours.

When notifying the , you will be asked for details of the , including the nature of the data and the affected data, the number of individuals and approximate number of data records affected, and details of a contact at your business from whom more information can be obtained. You will also be asked when and how you found out about the , what the likely consequences of the will be, and what measures you have taken to both address and minimise the risk associated with the .

See Personal data breach policy for a template that will allow you to produce an internal policy to help you comply with your obligation to notify the of a .


Q9:Does Brexit mean I have to notify any other authorities about personal data breaches?

It depends where your business processes data.

Following Brexit, the has been retained in law as the . The applies to data controllers and processors based in the , as well as those outside the whose data relates to individuals in the . The remains the supervisory authority in respect of law and data . This means that if your based business only processes of individuals in the , which is unlikely to affect individuals outside the , then you will only need to notify the about .

If, however, your data affects individuals outside the , you may need to report data to other authorities, as well as the . Before the end of the Brexit transition period on 31 December 2020, businesses cross-border data within the were able to identify a single lead supervisory authority for that data (eg the ), to avoid having to deal with more than one supervisory authority. From 1 January 2021, however, your business will need to report data to both the and the local supervisory authority in the relevant country. If you will be carrying out cross-border data with more than one country, review your business's structure and consider whether you will be able to have a single alternative lead supervisory authority in the , which you report to alongside the . This may be the case if you have an office, branch or other establishment in an country. If you do not have an establishment, then you will now need to report to both the and the separate supervisory bodies for every country in which your activities have been subject to the . For further guidance if your business processes data outside the , see Sharing personal data outside the UK.

Bear in mind that if you have no office, branch or other establishment in an country but you are offering , services or monitoring the behaviour of individuals there, then you may be required to appoint an representative to act on your behalf in relation to your compliance with the ; see Data processing agreements and data sharing agreements for more information.


Q10:When do I notify the individuals whose data has been affected about a personal data breach?

Where a carries a high risk to the rights and freedoms of individuals, and unless one of the exceptions set out below applies, you should inform those individuals who have been affected without delay.

Notification is not required if:

  1. you have in place protection measures which render the affected unintelligible to any person not authorised to access it (for example, where it's encrypted);

  2. having become aware of the , you have taken measures to minimise the potential high risk to individuals, so that is is no longer likely to materialise (for instance where customers' usernames have been compromised, you have suspended the accounts of the affected individuals so that unauthorised transactions cannot take place – although bear in mind you'll only be able to rely on this if you're certain no damage could have been done before you took these measures); or

  3. notification to individuals would require disproportionate effort (for instance where a large number of individuals are affected and you have incomplete or outdated contact details for such individuals). In such circumstances you should make a general public communication (such as a press release or statement on your business's website).

The timing of when you actually notify the affected individuals of a high risk will depend on the level of risk posed. If there is an immediate and acute risk to individuals, for instance where payment information has been compromised and you have evidence that it is likely to be used to make unauthorised transactions, prompt communication would be required. In exceptional circumstances, such as where you become aware individuals' payment information is being misused, this may require you to notify the affected individuals before you notify the .

See Q&A 11 for guidance on how to notify affected individuals and Notice of a personal data breach (affected individuals) for a template notice you can use.


Q11:How do I notify the individuals whose data has been affected about a personal data breach?

The notification to those concerned should be written in clear and plain language and should inform the individuals of the circumstances of the . The advises that, as a minimum, this should include the contact information for your (if you have one) or other relevant individual within your organisation, the likely consequences of the and the measures you have taken or propose to take to deal with it and (if relevant) to mitigate any possible adverse effects. It should also provide advice on practical steps they should take as a result and how you can help them. For a template notice, see Notice of a personal data breach (affected individuals).

Outside of exceptional cases with a particularly acute risk, the can generally assist you in determining when and how you should notify the affected individuals of a data . You should to work in cooperation with the when notifying affected individuals, and the has the power to require you to make a notification if you have not already done so. At the same time, you should not simply rely on the to determine whether you have an obligation to notify the affected individuals after a data , nor should you view notification to the as the end of your legal obligations. Regardless of whether the orders you to do so, you always have a legal obligation to carry out the described in Q&A 6 above, and if necessary make the appropriate notification to individuals.


Q12:Do I need to keep a record of the breach?

You should keep a written record of all that have occurred in your business, regardless of whether they need to be reported to the . This will enable you, where required, to demonstrate that you have complied with your notification duties under laws. The written record should set out the facts, the effects and the remedial action taken in relation to each . It could also include steps you have taken following your investigation into the cause of the to prevent it from recurring (eg providing training to if it was caused by human error).

This record might be kept in an internal notification register. For a template register, see Template personal data breach register.


Failing to notify or record a personal data breach
Q13:What happens if I fail to take action after a personal data breach occurs?

In the most serious cases, failure to notify the (or the affected individuals, if required) of a can result in a significant fine of up to £8.7 million or 2% of your global (whichever is higher). Failure to record a can also result in the same level of fine. Note that if the took place prior to 25 May 2018, the level of fine that can be imposed is different. See Q&A 14 for more information.

The has a range of penalties and sanctions that it can impose where there has been a . Generally, less serious or first-time offences are likely to result in a less serious penalty, however this will depend on all of the circumstances. The has discretion to issue the penalties set out below to anyone who fails to properly notify a

  1. Warnings

    If the believes that you have not yet law, but that you are likely to do so unless you change something about the way you are handling data , they can issue a warning. For example, they could issue a warning if you do not have a policy for dealing with a , or if you do not keep an internal register. If you ignore this warning, and fail to then respond promptly and appropriately to a , the penalties imposed on you could be much more severe.

  2. Reprimands

    A reprimand is a formal warning that you have law. You may be reprimanded in addition to other penalties. If you have been reprimanded and you later law in a similar way, the penalties imposed on you could be much more severe.

  3. Orders to notify individuals

    If you fail to properly notify an individual of a high risk that affects them, it is likely that, along with any other penalties imposed on you, the will order you to make the necessary notification. It may set a new deadline for you to do so, and if you fail to follow the order it may penalise you again, much more severely.

  4. Orders to change your systems

    If the believes that the systems you use to process are not compliant with law (eg you have poor data systems and policies, or you fail to record data ), it may order you to alter your systems to fix these problems.

  5. Temporary or permanent bans on data

    A ban on data (even only a temporary one) will usually only be issued if you have very severely law. To receive such a ban, there would likely need to be a significant failure by you to meet your legal obligations after a high risk .

  6. Fines

    Failure to properly notify or to record a can be met with a fine of up to £8.7 million or 2% of your global (whichever is higher), depending on the severity of the wrongdoing. While fines anywhere near that size are extremely unlikely for all but the biggest by major , smaller fines could be imposed alongside other penalties if you fail to respond promptly or adequately to a (particularly for deliberate attempts to conceal or downplay such a , or failures which relate to particularly sensitive data).


Obligations when a data breach occurred before 25 May 2018
Q14:What should I do if I become aware a data breach may have occurred before 25 May 2018?

If you discover a potential within your business, and the occurred before 25 May 2018, your obligations to notify, if necessary, the and the individuals concerned are the same as if the had happened after that date. You should therefore follow the same procedure set out above in Q&A 2 and following.

If it is clear that the took place before 25 May 2018, then the is likely to apply the previous rules in relation to the fines that it can impose for a data . The maximum fine that it can impose under the previous rules is £500,000. If, however, the took place just before 25 May 2018, or if it began prior to that date and continued afterwards, the may take that into consideration in determining whether to apply the old penalty regime or the new one. Under the new rules, where a business has failed to properly notify or record a , the can impose a fine of up to £8.7 million or 2% of your global (whichever is higher), depending on the severity of the wrongdoing.