Quick answer: If a personal data breach is likely to put people at risk, you must report it to the ICO without undue delay and within 72 hours of discovering it, even if you do not have every detail yet. If the risk to people is high, you must tell them too. Log every breach, reported or not.
A laptop left on a train, a referral letter emailed to the wrong address, a ransomware message on the reception PC. For a dental practice, care provider or small charity, the hard part is rarely the incident itself. It is knowing, under pressure, whether you need to report a data breach to the ICO and how fast. This guide sets out the rule in plain English, using the ICO’s own guidance read on 24 October 2026.
What counts as a personal data breach?
A personal data breach is a security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without permission, whether by accident or on purpose. The ICO’s guide to personal data breaches starts its definition with “a breach of security leading to the accidental or unlawful destruction” of personal data, and goes on to cover loss, alteration and unauthorised disclosure or access.
That is broader than hacking. Everyday examples in small organisations include:
- an email with a patient list or care notes sent to the wrong recipient;
- a lost or stolen phone, laptop or paper file with client details;
- a staff member looking at records they have no reason to see;
- ransomware that locks your systems so you cannot reach appointment or care records;
- a shared mailbox password that has been phished and used by someone else.
When do you have to report a breach to the ICO?
You have to report it when it is likely to result in a risk to people’s rights and freedoms. The ICO puts it simply: “If a risk is likely, you must notify the ICO; if a risk is unlikely, you don’t have to report it.”
Think about what could happen to the people involved. Could they suffer distress, discrimination, fraud, identity theft, damage to reputation or a loss of confidentiality? Health and care information, safeguarding notes, bank details and information about children usually push the risk up. An encrypted laptop that is lost, where the key is safe, usually brings it down. If you are unsure, the ICO offers a self-assessment tool and reporting page.
When does the 72-hour clock start?
The clock starts when you become aware of the breach, not when it happened. The ICO’s guide says you must report a notifiable breach “without undue delay, but not later than 72 hours after becoming aware of it”. Its 72-hour guide for small organisations puts it as the time “when you discovered the breach, not when it actually happened”.
The 72 hours include evenings and weekends. A breach found on a Friday afternoon is due by Monday afternoon. You do not need every answer before you report: the ICO says you can send a follow-up report with more detail later.
What should you do in the first hour?
The ICO’s small organisation guide lists seven steps, in this order:
- Don’t panic.
- Start the timer. Write down the date and time you found out.
- Find out what has happened. What data, how many people, who has it now?
- Try to contain the breach. Ask the wrong recipient to delete the email, reset passwords, disconnect an infected PC, or ask your IT provider to wipe a lost device.
- Assess the risk to the people involved.
- If necessary, act to protect those affected.
- Submit your report if it meets the threshold.
The ICO’s reporting page says the online form takes about 30 minutes and cannot be saved part way through, so gather the facts first. A report needs to describe what happened, the likely consequences and what you have done or plan to do about it. The ICO’s breach advice line is 0303 123 1113.
Do you need to tell the people affected?
You must tell them directly and without undue delay if the breach is likely to result in a high risk to them. That is a higher bar than the test for telling the ICO. Tell them in plain words what happened, what it means for them and what they can do, for example watching for phishing emails that use their details. Give them a named contact.
What records do you need to keep?
You must keep a record of every personal data breach, whether or not you report it. A simple breach log with the date found, what happened, the data and people involved, your risk decision and the reasons, and what you changed afterwards is enough for most small organisations. The ICO’s guide warns that failing to notify a reportable breach can bring a fine of up to £8.7 million or 2 per cent of global turnover. A clear log of a sensible decision is your best protection. Data protection law is also changing under the Data (Use and Access) Act 2025, and the ICO notes that some of its breach guidance is under review, so check its pages on the day you need them.
If you hold patient or care records, the same log can sit alongside your wider records on handling requests, such as our guide to subject access requests, and the evidence you keep for the DSPT. For real examples of what goes wrong, see our reported incidents pages.
FAQs
Do we have to report a breach if we are not sure of the facts yet?
Yes, if it is likely to be reportable, report within 72 hours with what you know. The ICO says you can submit a follow-up report with more detail later. Waiting for the full picture is not a reason to miss the deadline.
Is an email sent to the wrong person a reportable breach?
It is always a personal data breach, but it is not always reportable. Ask what the email contained and who received it. A clinic letter or care plan sent to the wrong family is far more likely to need reporting than a meeting invite, so assess the risk and log your decision either way.
Who should report the breach in a small practice or charity?
The organisation that decides how the data is used, usually the practice, provider or charity itself, reports to the ICO. Name one person, often the practice manager or a trustee, to own the response, and agree a deputy for holidays. If a supplier caused the breach, they should tell you quickly so you can meet the deadline.
Does a ransomware attack count as a personal data breach?
Usually, yes. If personal data is encrypted, made unavailable or copied by the attackers, that is a breach of security affecting personal data. Assess the risk to people in the same way and report to the ICO if it is likely, as well as reporting the crime.
How we can help
Unavoidably Secure helps dental practices, care providers and small charities find the weak spots that most often lead to a breach: exposed website data, email that can be spoofed and accounts without multi-factor authentication. We give you a plain-English list of what to fix first. We do not certify, accredit or guarantee compliance.
This article is general information, not legal advice. Facts were checked against the ICO’s personal data breach guide, its 72-hour guide for small organisations and its reporting page on 24 October 2026. If you think you have a breach now, start the timer and contact the ICO, or browse the blog for related guides.
Close the gaps before a breach happens
Book a free external audit. We will review your website, email security and data basics, and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day.