A breach rarely arrives with a label on it. More often it is a payroll spreadsheet sent to the wrong address, a laptop left on a train, a supplier's system that quietly hands over customer logins, or a call from someone who already knows too much about your staff. What matters next is not how it happened, but what you do in the first few hours.

The 72-hour clock starts when your organisation becomes aware of a personal data breach — not when you finish investigating. You can, and should, keep investigating while you report. Here is a practical order of work.

Put one person in charge and start a log

Name an incident lead before anything else. In a small business this is often the owner or operations manager, but it does not have to be the most senior person — it needs to be someone who can make decisions quickly and is not already firefighting.

Name a deputy too, in case the lead is unreachable. Then open a document and start writing things down with times: when you first became aware, who spotted it, what you have seen so far, who you have told. This log becomes the backbone of both your ICO report and your internal review. Memories turn unreliable within hours.

Contain the breach without destroying the evidence

Containment means stopping the harm while preserving what you will need to understand it. Resist the urge to tidy up.

1. Cut off the onward flow. Suspend the compromised account, change passwords, revoke access tokens, close the shared folder, recall the misdirected email if you still can.
2. Isolate, don't erase. If a device is affected, disconnect it from the network rather than wiping it, and pull the logs before deleting anything.
3. Contact third parties. If a processor, hosting provider or payroll bureau is involved, tell them immediately and ask what they can see from their side. They must notify you without undue delay.
4. Ask for deletion. If data has landed in the wrong inbox, a prompt request for deletion and written confirmation is worth making — and worth recording.

Record every action as you take it. If you later need to explain how quickly you responded, timestamps are your evidence.

Decide whether the ICO needs to know

Under UK GDPR, you must report a personal data breach to the Information Commissioner's Office within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. There is no fee, and the ICO provides an online reporting form. Processors report to the controller; the controller decides whether the ICO needs to hear about it.

Where is the line? It comes down to risk. These factors usually push a breach towards reportable:

• Special category data — health, ethnicity, religion, sexual orientation, biometrics.
• Financial details, bank account numbers, card data or payroll records.
• Login credentials, especially where people reuse passwords elsewhere.
• Data about children or vulnerable adults.
• Enough information to identify someone, or to impersonate your business convincingly.
• A real chance of fraud, phishing or identity theft.

If you are genuinely unsure, report and explain your uncertainty. Reporting is not a confession of failure, and regulators tend to be far more interested in a business that engages early than one that goes quiet. For anything complex, involve your insurer and a solicitor early. This is general guidance, not legal advice.

Telling the people affected

If a breach is likely to result in a high risk to individuals, you need to tell them without undue delay, in plain language. Write it as you would want to receive it: what happened, what information was involved, what you have done to contain it, what they should do, and who to contact with questions.

Be specific. "We take data protection seriously" tells nobody anything. "Your name, email address and password were visible to another customer between 09:15 and 10:40 on Tuesday" does. If passwords may be exposed, tell people to change them anywhere they are reused. Where identity fraud is a genuine risk, point them towards organisations that help — Action Fraud and the credit reference agencies both publish clear guidance.

Communicating with your staff

Your team should hear about a serious breach from you, not from a customer or a journalist. Brief them before you publish anything external if you can, and give them three things: a short factual summary, an agreed answer for the questions you expect, and the name of one person who handles all enquiries.

What not to do

Do not name and blame the person who clicked the link — people stop reporting mistakes the moment they fear punishment, and that costs you far more than the original error. Do not speculate in group chats or on social media. Do not ask staff to delete messages or records, which turns a manageable incident into a serious one. And expect a wave of phishing emails that reference the breach; warn everyone.

Keep a record, even if you don't report

You are required to document every personal data breach, whether or not it is reportable. Your record should cover the facts, the data and number of people affected, the likely consequences, the action taken, and your reasoning for reporting or not reporting — including who decided, and when.

Store it somewhere with limited access and make sure it is backed up. Insurers, auditors and the ICO may all ask for it, sometimes long after you have moved on to other things.

After the first 72 hours

Once the immediate pressure lifts, set aside an hour within a fortnight to review what happened. Which parts went smoothly, and which took longer than they should have? Then make small, concrete changes: add a breach section to your incident plan, test that your staff contact list actually works, check you can restore the affected system from backup, and write data protection expectations into the contracts you sign.

Rehearse the plan occasionally. A tabletop exercise over coffee is enough. The point is not to become an expert in incident response; it is to make the first hour of a bad day feel familiar, so your decisions are deliberate rather than panicked.

For a serious breach, or one involving legal risk, speak to a solicitor or your insurer before you finalise your position.

Photo: 089photoshootings / Pixabay