How to Respond to a Data Breach: The 72-Hour GDPR and ICO Notification Steps

This guide sets out the steps, the legal tests and the EU's plan to move to 96 hours.

What counts as a personal data breach

A personal data breach is any security incident that affects personal data, not only a hack or a theft. Article 4(12) of the General Data Protection Regulation defines it as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The ICO frames it as an incident affecting the confidentiality, integrity or availability of personal data, whether accidental or deliberate.

• Confidentiality breaches. Data is disclosed to, or accessed by, someone who should not see it: an email to the wrong recipient, a misconfigured cloud folder or an attacker copying a customer database.
• Integrity breaches. Data is altered without authority, as when fraudsters change a customer's contact details to take over an account.
• Availability breaches. Data is lost or cannot be accessed. The European Data Protection Board gives the example of the only copy of a data set being encrypted by ransomware, which can also be a confidentiality breach if the attacker accessed the data.

Encryption changes the analysis but does not make the incident disappear. In its Guidelines 9/2022 on personal data breach notification, the EDPB explains that losing data protected by state-of-the-art encryption is still a breach, but if the key was not compromised the data is in principle unintelligible and the breach may be unlikely to harm anyone. The wider fight over access to encrypted data, covered in our report on Apple's challenge in the Investigatory Powers Tribunal, shows why regulators treat strong encryption as a meaningful safeguard.

When the 72-hour clock starts

The 72 hours run from the moment the controller becomes aware of the breach, not from when the breach happened. The EDPB's legal test is that a controller is aware when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.

• A short investigation is allowed. After an alert, a controller may take a brief period to establish whether a breach has really happened, and is not yet treated as aware. That investigation must start as soon as possible.
• Delay is not a defence. If a controller fails to act promptly on an alert and a breach is later confirmed, the EDPB says this can itself be treated as a failure to notify under Article 33.
• Clear evidence ends the debate. Awareness is immediate when, for example, a USB stick holding unencrypted data is lost, a third party reports receiving a customer's data, or a ransom demand is confirmed by checking the systems.

The 72 hours are calendar hours, not working hours. The EDPB and the European Data Protection Supervisor acknowledged in their Joint Opinion 2/2026 on the Digital Omnibus that the deadline may include weekends and bank holidays, which is particularly hard for smaller organisations. A breach confirmed on a Friday afternoon must be reported by Monday afternoon if it meets the threshold.

How to respond to a data breach: eight steps

The fastest way to respond to a data breach is to run containment, fact-finding and the legal assessment in parallel, with one named person owning the decision to notify. The steps below follow the ICO's 72-hour guidance on responding to a personal data breach and the practical steps in the EDPB guidelines.

1. Escalate to the response owner. The EDPB recommends that every security event goes to a responsible person or team whose job is to establish whether a breach has occurred and to assess risk.
2. Start a breach log. The ICO advises starting a log even if the breach may not need reporting, recording what happened, who is involved and what is being done. It publishes a template.
3. Establish the facts. Work out what happened and why, how many people and records are affected, the categories of data, a timeline and the actions taken so far.
4. Contain the breach. Ask an unintended recipient to delete or return the data, wipe a stolen laptop remotely if the systems allow, and change passwords after a cyber incident. Forensic investigators can preserve evidence while systems are restored.
5. Assess the risk to individuals. Consider the likelihood and severity of harm such as identity theft, fraud, financial loss or significant distress. The ICO suggests imagining yourself as the person affected.
6. Decide on notification and record why. If the breach is likely to result in a risk to people's rights and freedoms, notify the regulator. If not, document the decision and reasoning.
7. Notify the regulator and, if needed, the individuals. Report within 72 hours even if details are missing, and tell affected people without undue delay if the risk to them is high.
8. Follow up and learn. Send further information as the investigation progresses and fix the root cause. The ICO notes that its main aim is to help prevent similar incidents and that not every report leads to formal action.

Where an attack is criminal, cyber security specialists will run the technical response, but the legal clock runs alongside it. The most common failure is letting the forensic work set the timetable for the notification decision.

The first 72 hours at a glance

This working timeline is a planning aid; the only fixed points in the law are "without undue delay" and the 72-hour limit.

Window	Key actions	Legal anchor
Alert received	Escalate to the response owner, open the breach log, investigate briefly to confirm whether personal data is affected	EDPB awareness test
Awareness (hour 0)	Record the date and time of awareness; contain the breach; instruct forensic and legal support	Article 33(1): clock starts
Hours 0 to 24	Establish facts and approximate numbers; assess risk; check processor roles and parallel regimes such as NIS2 or DORA	Articles 33(1), 33(2)
Hours 24 to 72	Decide on notification; submit the initial report; prepare messages to individuals if risk is high	Articles 33(3), 33(4), 34
After 72 hours	Send phased updates; give reasons for any delay; complete remediation and the internal record	Articles 33(1), 33(4), 33(5)

When to report a data breach to the ICO or a regulator

You must report a breach to the regulator unless it is unlikely to result in a risk to people's rights and freedoms, and you must also tell the individuals if it is likely to result in a high risk. The test is about consequences for people, not the size of the incident. The ICO's guide to personal data breaches gives worked examples.

Risk level	What you must do	Example from regulator guidance
Unlikely to result in a risk	Record the breach and the reasons for not notifying	Loss or inappropriate alteration of a staff telephone list; an appointment reminder emailed to the wrong customer, who deletes it
Likely to result in a risk	Notify the regulator within 72 hours; telling individuals is optional	Theft of a customer database whose data could be used for identity fraud
Likely to result in a high risk	Notify the regulator within 72 hours and tell affected individuals without undue delay	A hospital accidentally disclosing patient records that expose sensitive medical details

When unsure, organisations can use the ICO's online self-assessment tool or its personal data breach advice line on 0303 123 1113. The ICO notes that its 72-hour guidance is under review following the Data (Use and Access) Act 2025, so it is worth checking for updates.

What a breach notification must include

A notification must describe the breach, give a contact point, explain the likely consequences and set out what the organisation is doing. Under Article 33(3) GDPR, as summarised by the ICO, the report must include:

• The nature of the breach, including where possible the categories and approximate number of individuals and records concerned.
• Contact details of the data protection officer or another contact point.
• The likely consequences of the breach.
• The measures taken or proposed to deal with the breach and mitigate its effects.

Incomplete information is not a reason to wait. Article 33(4) allows information to be provided in phases without undue further delay, and a report made after 72 hours must give the reasons for the delay. The EDPB adds that multiple similar breaches can sometimes be reported in a bundled notification, but warns that delayed notifications should not become routine. In the UK, reports go through the ICO's online form; in the EU, each supervisory authority runs its own process.

Telling affected individuals

When a breach is likely to result in a high risk, Article 34 requires the controller to tell the people affected directly and without undue delay, in clear and plain language, including the contact point, the likely consequences and the measures taken. The ICO recommends specific advice, such as resetting passwords and watching for phishing or fraud. Firms holding account records should also expect follow-up requests from victims, as the US action over identity-theft victims' records illustrates.

The EDPB recommends dedicated messages, not warnings tucked into newsletters. Article 34(3) removes the duty in three situations:

• Protective measures such as state-of-the-art encryption rendered the data unintelligible to anyone not authorised to access it.
• Immediate follow-up action means the high risk is no longer likely to materialise.
• Direct contact would involve disproportionate effort, for instance because contact details were lost; a public communication that informs people equally effectively is then required.

Cross-border breaches: which regulator to notify

An organisation with a main establishment in the EU notifies its lead supervisory authority, but a controller outside the EU must notify every authority in whose member state affected individuals live. The EDPB guidelines say the lead authority is the sole interlocutor for cross-border processing, and a controller in doubt about which authority leads should at a minimum notify the local authority where the breach took place.

Version 2.0 of the guidelines, adopted on 28 March 2023, settled a question that matters for UK, US and Asian companies selling into Europe. A controller not established in the EU but subject to the GDPR under Article 3(2) is still bound by Articles 33 and 34, and having an EU representative under Article 27 does not trigger the one-stop-shop system. A breach affecting customers in ten member states can therefore mean ten notifications.

Because the UK GDPR and the EU GDPR now operate as separate regimes, a group with customers on both sides of the Channel should plan on the basis that one incident may need assessing, and possibly reporting, under both. The same mapping underpins international data flows, as our analysis of whether the EU-US Data Privacy Framework is still valid explains.

Processors, joint controllers and contracts

A processor does not notify the regulator; it must tell the controller without undue delay, and the controller then decides. Article 33(2) sets no fixed hour limit for processors, so the EDPB recommends prompt notice with details in phases, and early-notification terms in the contract to support the controller's 72-hour deadline. In principle, the controller is treated as aware once the processor has informed it, and a processor serving several affected controllers must report to each.

Controllers should check that Article 28 processing agreements contain a short notice period, a named contact and a duty to cooperate. Joint controllers should agree under Article 26 which of them handles notifications; the EDPB recommends writing this into their arrangement rather than negotiating it mid-incident.

Other notification regimes that may run in parallel

One cyber incident can trigger several reporting duties, some on shorter deadlines than the GDPR. The EDPB-EDPS joint opinion lists the NIS2 Directive (24 or 72 hours depending on the obligation), the Digital Operational Resilience Act for financial entities (24 or 72 hours), the eIDAS Regulation for trust service providers (24 hours) and the Critical Entities Resilience Directive (24 hours). These duties are often owed to different authorities.

In the UK, electronic communications providers also report breaches under the Privacy and Electronic Communications Regulations. The ICO's summary of the Data (Use and Access) Act 2025 changes says the Act moves that deadline from 24 hours to "not later than 72 hours" after awareness where feasible, aligning it with the UK GDPR.

What happens if you notify late: fines and enforcement

Failing to notify, or notifying late, is a separate infringement from the security failure behind the breach, and regulators fine it separately. Under Article 83(4)(a) GDPR, breaches of Articles 33 and 34 carry fines of up to €10 million or up to 2% of total worldwide annual turnover, as the EDPB guidelines confirm. The ICO warns that failing to notify in the UK can lead to a fine of up to £8.7 million or 2% of global turnover.

The Data Protection Commission's PTSB decision of 8 May 2026 shows both infringements at work. Three related breaches, first reported in May 2022, occurred when people who already held some customer information phoned the bank's Open24 contact centre posing as customers and changed account details. The DPC reprimanded PTSB, fined it €250,000 under Articles 5(1)(f) and 32(1) on security, and €27,500 under Article 33(1) for late notification. The same regulator has acted on other grounds too, including its €403m location data fine against Google.

Article 33(5) also requires every breach to be recorded, with its facts, effects and remedial action, whether or not it is reported; that record is how a regulator tests a decision not to notify.

How the rules may change: the Digital Omnibus and 96 hours

The EU is considering a higher threshold and a longer deadline, but until any amendment is adopted and in force the 72-hour rule applies. On 19 November 2025 the European Commission published its digital omnibus package, proposing among other things a single entry point for incident reports under laws including NIS2, the GDPR and DORA. The EDPB-EDPS joint opinion of 10 February 2026 supports the main GDPR changes:

• Higher threshold. Only breaches likely to result in a high risk would be notified to the regulator. Some authorities receive thousands of notifications a year; the Irish DPC received 7,781 valid notifications in 2024.
• Longer deadline. 96 hours instead of 72, still subject to "without undue delay".
• Common template and list. The EDPB would prepare a notification template and a list of high-risk circumstances, though the regulators object to the Commission being able to amend them unilaterally.

The Council agreed its negotiating position on 21 October 2026. According to IAPP reporting, member states preferred national entry points for cybersecurity incident reports over a single EU-level one, and trilogues can begin once the European Parliament settles its position. The AI strand of the omnibus has moved faster, as our guide to the AI Act timetable after the omnibus delay explains. UK law is unaffected.

Common data breach response mistakes

Most enforcement problems come from process failures rather than the breach itself:

• Waiting for certainty. Treating the forensic report, rather than a reasonable degree of certainty, as the trigger.
• Counting working days. Forgetting that weekends and bank holidays count.
• Not recording "no notify" decisions. Every breach must be logged with the reasoning.
• Treating an EU representative as a one-stop shop. Non-EU controllers must notify each relevant authority.
• Overlooking insurance. Cyber policies often have their own notification conditions; insurance specialists can confirm them before the insurer's deadline passes.

Related Corporate INTL guides

Guide	Why it is relevant
Why the European Commission is fining X	How EU digital regulators calculate and defend fines in court
How Ofcom enforces the Online Safety Act	UK regulator investigation powers in the technology sector
Why Coinbase was fined in Ireland	How an Irish financial regulator treats notification failures and self-reporting

When to bring in a data protection adviser

Take specialist advice as soon as an incident may involve personal data, because the decisions that matter most, on awareness, risk and which regulators to notify, are made in the first day. Advice is especially valuable where special category, children's or financial data is involved, where people in several countries are affected, where a ransom has been demanded, or where the breach may lead to an investigation or claims.

The Corporate INTL directory lists technology, media and telecoms lawyers who advise on data protection and breach response, including technology lawyers in the United Kingdom, as well as regulatory lawyers for dealings with the ICO and EU authorities, dispute resolution lawyers for follow-on claims and advisers in Ireland, where many international groups have their EU lead authority. To be put in touch with a suitable member, describe the matter in the "Looking for legal or business advice?" enquiry form on this page and the Corporate INTL team will help find the right adviser, or browse the full Find an Expert directory.

Frequently asked questions

What is the first thing you should do if you suspect a data breach?

Escalate it to the person or team responsible for incidents and start a breach log straight away. Then establish the facts and contain the breach, for example by recalling a misdirected email or changing compromised passwords. The 72-hour clock starts once there is a reasonable degree of certainty that personal data has been compromised.

Do you need to report all data breaches to the ICO?

No. You must report a personal data breach to the ICO unless it is unlikely to result in a risk to people's rights and freedoms. Every breach must still be recorded internally with the reasons for the decision, so that the ICO can check a decision not to report.

What is the 72-hour notification rule for GDPR breaches?

Article 33 GDPR requires a controller to notify the supervisory authority of a reportable breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The hours include weekends and bank holidays. A late report must explain the reasons for the delay, and information can be sent in phases.

When does the 72-hour clock start?

It starts when the controller becomes aware of the breach, which the EDPB defines as having a reasonable degree of certainty that a security incident has compromised personal data. A short initial investigation is allowed, but it must begin promptly. If a processor suffers the breach, the controller is in principle aware once the processor tells it.

What must a data breach notification include?

It must describe the nature of the breach, including where possible the categories and approximate numbers of people and records affected; give the contact details of the data protection officer or another contact; describe the likely consequences; and set out the measures taken or proposed to address the breach and limit its effects.

When do you have to tell the people affected?

You must tell individuals directly and without undue delay when the breach is likely to result in a high risk to their rights and freedoms. Exceptions apply where the data was protected by measures such as strong encryption, where follow-up action has removed the high risk, or where direct contact would be disproportionate, in which case a public notice is needed.

What are the fines for failing to report a data breach?

Under the EU GDPR, breaches of the notification rules can attract fines of up to €10 million or up to 2% of worldwide annual turnover. The ICO says failing to notify in the UK can lead to a fine of up to £8.7 million or 2% of global turnover. In May 2026 the Irish DPC fined PTSB €27,500 for late notification.

Which regulator do you notify if people in several EU countries are affected?

A controller with a main establishment in the EU notifies its lead supervisory authority. A controller outside the EU that is subject to the GDPR must notify the supervisory authority in every member state where affected individuals live, because appointing an EU representative does not trigger the one-stop-shop system.

Is the GDPR breach deadline changing to 96 hours?

Not yet. The European Commission's Digital Omnibus proposal of November 2025 would extend the deadline to 96 hours and require notification only for high-risk breaches. The Council agreed its negotiating position on 21 October 2026, but the proposal still needs agreement with the European Parliament. Until then, the 72-hour rule applies.

Sources

1. EUR-Lex: Regulation (EU) 2016/679, the General Data Protection Regulation
2. Information Commissioner's Office: 72 hours, how to respond to a personal data breach
3. Information Commissioner's Office: Personal data breaches, a guide
4. Information Commissioner's Office: Data (Use and Access) Act 2025, privacy and electronic communications changes
5. European Data Protection Board: Guidelines 9/2022 on personal data breach notification under GDPR (version 2.0)
6. Data Protection Commission: Final decision following inquiry into Permanent TSB (8 May 2026)
7. EDPB and EDPS: Joint Opinion 2/2026 on the Digital Omnibus proposal (10 February 2026)
8. European Commission: Simpler EU digital rules and new digital wallets (19 November 2025)
9. IAPP: EU member states finalize negotiating stance on Digital Omnibus

About this article

This guide was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the text of the GDPR, guidance from the Information Commissioner's Office and the European Data Protection Board, the Irish Data Protection Commission's PTSB decision and official material on the Digital Omnibus proposal. The ICO has said its breach guidance is under review following the Data (Use and Access) Act 2025, and the Digital Omnibus remains a proposal. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 26 October 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.