A personal data breach is any security incident that leads to personal data being lost, changed, accessed or shared without permission: a hacked mailbox, a website leaking customer details, a lost laptop. Under UK GDPR, if it's likely to put people at risk you must report it to the ICO within 72 hours of becoming aware of it, and tell those affected if the risk is high.
Hour 0 to 4: contain it
- Change passwords and sign out all sessions on affected accounts.
- Turn on multi-factor login.
- Take a hacked website offline or into maintenance mode if it's leaking data.
- Don't wipe anything: preserve logs and copies for investigation.
Hours 4 to 48: establish the facts
What happened and when, which systems were involved, what personal data was exposed, how many people, and whether it was actually accessed or just exposed. Sign-in logs, server logs and email audit logs answer most of this.
Before 72 hours: decide and report
Use the ICO's self-assessment tool to decide whether to report. If you report, you can send what you know and add details later. Tell your cyber insurer too, as most policies require prompt notice.
Afterwards
Close the way in, warn customers about fake payment requests if email was involved, and put basic protections in place: MFA, updates, backups and email authentication.
We contain breaches and give you the technical facts the ICO will ask for: data breach help.
