Data breach and incident notification in the United Kingdom

Four separate reporting regimes

The ICO's reporting page lists four kinds of report ⁷. Each has its own legal basis and its own recipient group ⁷.

UK GDPR Article 33

A controller must notify a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it ¹. No notice is needed if the breach is unlikely to result in a risk to the rights and freedoms of natural persons ¹. A notice made after 72 hours must give reasons for the delay ¹.

Processors tell the controller without undue delay ¹. Details may be sent in phases ¹. Controllers must document every breach, its effects and the remedial action taken ¹. The current text names the regulator as the Commission ¹.

PECR: telecoms and internet providers

Regulation 5A of the Privacy and Electronic Communications Regulations 2003 was inserted on 26 May 2011 ³. It requires a service provider to notify a personal data breach to the regulator without undue delay ³. The words where feasible, not later than 72 hours after having become aware of it were inserted on 20 August 2025 by the Data (Use and Access) Act 2025 ³. A new paragraph 3A requires reasons for any delay past 72 hours ³.

If a breach is likely to adversely affect a subscriber's or user's personal data or privacy, the provider must notify that person without undue delay ³. That notice is not needed where the provider has shown the regulator that the data was made unintelligible by technological protection ³. Providers must keep an inventory of breaches with the facts, effects and remedial action ³.

NIS Regulations 2018

An OES, the term the Regulations use for a designated service operator, must notify its designated competent authority in writing of any incident with a significant impact on the continuity of the service it provides ⁴. The notice is due without undue delay and in any event no later than 72 hours after the operator is aware of the incident ⁴. Factors include the number of users affected, the duration and the geographical area ⁴.

The competent authority shares the information with the CSIRT and may inform the public where it considers public awareness necessary ⁴. Each competent authority sends an annual report on the number and nature of notified incidents ⁴.

Penalties

UK GDPR Article 83(4) sets fines up to £8,700,000, or 2% of total worldwide annual turnover for an undertaking, whichever is higher, for breaches of Articles 25 to 39 ². The notice duties in Articles 33 and 34 sit in that range ². Section 157 of the Data Protection Act 2018 sets the higher maximum at £17,500,000 or 4% of turnover and the standard maximum at £8,700,000 or 2% ⁶. Failing to comply with an information notice, assessment notice or enforcement notice attracts the higher maximum ⁶.