A lost work phone, a quote sent to the wrong email address or a customer photo shared in the wrong group can expose personal information. A breach is not limited to a cyberattack: it can also be accidental loss, alteration or unauthorised disclosure.
The ICO says organisations must report certain personal-data breaches to it within 72 hours of becoming aware, where feasible. That does not mean every mistake must be reported. You must assess the likely risk to people's rights and freedoms, and tell affected individuals without undue delay where the breach is likely to create a high risk. Record all personal-data breaches, even those you do not report.
First actions
- Contain it. Revoke a shared link, recover a misdirected document if possible, lock a missing phone or remove incorrect public content.
- Preserve the facts. Note what happened, when you found out, which systems and people may be involved, and what information was exposed.
- Assess the risk. Consider the data type, number of people, whether it can be recovered and what someone could do with it.
- Escalate and decide. Assign one person to coordinate the response and consult the ICO guidance or a qualified adviser where needed.
- Record the outcome. Document your decision to notify or not notify, your reasons, and the steps taken.
Do not wait until you have a perfect investigation before starting the assessment. The ICO's 72-hour window applies where a report is required, so capture the time the organisation became aware and get help promptly if the incident may be serious.
Prepare before an incident
Keep a current list of where customer details are stored, who can access them and how to report a suspected incident. Enable device locks and account security, limit staff access to what they need, and make sure you can revoke access when a phone or contractor is no longer in use.
Read the ICO's personal data breach guide. This is general information, not legal advice. For routine controls, see our guide to keeping customer enquiry data only as long as needed.