Does every data breach need to be reported to the ICO?

No. Organisations need to assess the likely risk to individuals. If a risk to people’s rights and freedoms is likely, the breach should be reported to the ICO. If the organisation decides not to report, it should record the decision and the reasons for it.

When does the 72-hour breach reporting clock start?

For a notifiable personal data breach, the 72-hour period starts when the organisation becomes aware of the breach. Organisations should not wait for every detail before starting their assessment.

Do affected people need to be told about a data breach?

Affected individuals should be told directly and without undue delay if the breach is likely to result in a high risk to them. The message should explain what happened, what information may be involved, what the organisation has done and what practical steps people can take.

Can Black Swan Cyber Security Solutions help after a breach?

Black Swan Cyber Security Solutions can help organisations understand what to fix next and how to reduce future cyber risk. Existing managed clients should contact Black Swan through their normal support route.

Data Breach: Steps to take

Data breach help for individuals and small organisations

Involved in a data breach? Start with calm, practical action.

A data breach can feel messy very quickly. Passwords, bank details, customer records, staff information, emails, files and fraud risk all start to blur together. The first job is not to panic. The first job is to work out what happened, what data may be involved, who needs to know and what can be done now to reduce harm.

Show me the steps Ask Black Swan for help

What to do first

The first few hours matter

You do not need perfect information before taking sensible action. In most cases, the right approach is to contain the issue, protect accounts, gather facts and keep a clear record of what you have done.

Secure your accounts

Change passwords on affected accounts and anywhere the same password has been reused. Turn on multi-factor authentication where available.

Check your bank and cards

Contact your bank or card provider if financial details may be involved. Watch for unusual payments, new payees or credit applications.

Watch for phishing

After a breach, criminals may use leaked details to make emails, texts and phone calls sound more believable.

Report fraud or cyber crime

If you have been scammed, defrauded or affected by cyber crime, report it through Report Fraud.

Protect documents

If passports, driving licences or other official documents are involved, contact the issuing organisation for advice.

Keep notes

Record dates, emails, phone calls, screenshots, reference numbers and actions taken. It helps with banks, insurers, regulators and future decisions.

For businesses, charities, schools and care providers

If personal data is involved, this becomes more than an IT problem

A cyber incident and a personal data breach are not always the same thing. A laptop infection, phishing email or compromised Microsoft 365 account may become a personal data breach if personal information has been lost, accessed, altered, disclosed or made unavailable in a way that affects people.

Contain the incident

Disable compromised accounts, reset passwords, revoke sessions, isolate affected devices and preserve logs. Do not wipe evidence before you understand what happened.

Work out what data may be affected

Look at the type of information involved, the number of people affected, the sensitivity of the data and whether the information may have been copied or misused.

Assess the risk to people

The ICO expects organisations to focus on the possible impact on individuals. This could include fraud, identity theft, distress, loss of confidentiality, financial harm or damage to reputation.

Decide whether to report to the ICO

If a risk to people’s rights and freedoms is likely, you should report the breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If you do not have the full picture yet, report what you know and update later.

Tell affected people when the risk is high

If the breach is likely to result in a high risk to individuals, they should be told directly and without undue delay. Keep the wording clear, practical and calm.

Record every decision

Even if you decide the breach is not reportable, record the facts, the impact, the decision-making and the steps taken. This helps show accountability.

Who else may need to know?

A breach can trigger more than one notification

The ICO is only one part of the picture. Depending on what has happened, you may also need to contact other organisations.

Consider contacting

Report Fraud, if fraud or cyber crime is involved.
Your cyber insurer or broker, especially before paying for recovery work.
Your bank or payment provider, if financial details are affected.
Your IT or cyber security provider.
Your data protection officer, if you have one.
Sector bodies, professional bodies or contract owners where required.

Information to gather

What happened and when it was discovered.
What systems, accounts or devices were affected.
What personal data may be involved.
How many people may be affected.
What you have done to contain the issue.
What support or advice you are giving to affected people.

Plain English advice

What to say to affected people

People do not need vague reassurance. They need to know what happened, what it means for them and what they should do next.

A simple structure

Explain what happened in clear language.
Say what personal information may be involved.
Explain the possible consequences.
Tell people what you have done to reduce the risk.
Give practical steps they can take, such as changing passwords, watching for phishing emails or contacting their bank.
Provide a contact point for questions.

After the breach

The clean-up matters as much as the first response

Once the immediate pressure has eased, the next question is simple: how do you stop the same thing happening again?

Managed detection

Huntress EDR

Managed endpoint detection and response for organisations that need human-led monitoring, not just another alert dashboard.

Microsoft 365 identity protection

Huntress ITDR

Helps spot suspicious Microsoft 365 identity activity, account compromise and behaviour that may otherwise be missed.

24/7 support layer

Heimdal MXDR

Managed detection and response for organisations that need extra security visibility and support without building a full security team.

Recovery planning

Cloud backup

Backup and recovery support for businesses that need to know their Microsoft 365 data and key systems can be restored.

Password security

Keeper Password Manager

Helps staff use strong, unique passwords without relying on memory, spreadsheets or browser-saved passwords.

Baseline controls

Cyber Essentials

A practical way to improve basic security controls and show customers, insurers and suppliers that cyber risk is being taken seriously.

FAQs

Common questions after a data breach

What is a data breach?

A data breach happens when personal information is lost, accessed, disclosed, changed or made unavailable without proper authorisation.

Does every breach need to be reported to the ICO?

No. You need to assess the likely risk to individuals. If risk is likely, report it. If you decide not to report, document why.

When does the 72-hour clock start?

For a notifiable personal data breach, the clock starts when your organisation becomes aware of it. Do not wait for every detail before starting the assessment.

Do we need to tell affected people?

If the breach is likely to create a high risk to people, they should be told directly and without undue delay.

Is Report Fraud the same as Action Fraud?

Report Fraud has replaced Action Fraud as the national service for reporting fraud and cyber crime.

Can Black Swan help during a breach?

If you are an existing managed client, contact us through your normal support route. If you are not a client, we may still be able to help you understand what to fix next and how to reduce future risk.

Need to strengthen your defences?

Put better protection in place before the next scare

Black Swan Cyber Security Solutions helps smaller organisations in Chesterfield, Derbyshire, Sheffield and South Yorkshire improve cyber security with practical tools, plain English advice and managed protection that fits real teams.

Book a quick security check Cyber security in Chesterfield

Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you! From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.

Ready to replace sleepless nights with peace of mind? It all starts with an informal chat! Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.

Stay ahead of cyber threats - Subscribe to the Black Swan newsletter

Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.

Join the Black Swan community today and take charge of your cyber security.

Click here to preview an example newsletter and see what you’ll gain by subscribing!