Don't Breach the Breach!
- dataprotectionmanage
- Nov 21
- 3 min read
This week we’re focusing on what the ICO expects from organisations when a data breach occurs — and how you can stay ahead of the risks.
When a data breach happens, the ICO is clear: organisations must act fast, stay transparent, and put people's data first. This isn’t just about ticking boxes — it’s about protecting data, maintaining trust and avoiding serious penalties! Organisations must have robust processes in place to manage a data breach effectively!
Contain and record immediately
Stop the breach spreading and keep a detailed log of what happened, what data was affected, and what you’ve done so far. That log isn’t just good practice — it’s your evidence if the ICO comes knocking.
Notify your DPO without delay
Internal processes must alert the Data Protection Officer (DPO) straight away. The DPO assesses whether the breach is notifiable and guides the next steps.
Report to the ICO within 72 hours
If the breach is notifiable, the ICO expects to hear from you within 72 hours of discovery. To help decide, use the ICO’s self‑assessment tool — not only to judge if the breach must be reported, but also to guide whether affected data subjects need to be notified.
Communicate with individuals — but only if high risk
Likely risk → notify the ICO if notifiable.
Likely high risk → notify the ICO and communicate directly with affected individuals.
When communication is required, advise on practical steps like reporting lost documents, monitoring bank activity, and using strong passwords.
Why this matters
The ICO can impose fines of up to £17.5 million or 4% of annual global turnover for failing to respond to a data breach properly, whether that’s not reporting within 72 hours, not notifying affected individuals when required, or lacking adequate breach management processes. Beyond the numbers, breaches erode trust. Demonstrating that you can contain, record, notify, and communicate effectively when managing breaches demonstrates accountability and protects your reputation.
Contain quickly. Record accurately. Notify your DPO. Report within 72 hours of a receiving notice of a notifiable breach! Use the ICO’s self‑assessment tool to decide both if the breach is notifiable and whether individuals must be informed. You must Communicate to affected individuals if the breach presents a high risk to their rights and freedoms.
At Data Protection Management Consultants (DPMC) Get Ahead!®, we help organisations turn these ICO principles into practical steps that work for their operations, teams, and strategic direction. Whether it’s building breach response policies or processes, training staff, or guiding you through ICO reporting, we’ll make sure you’re prepared.
Reach out today at support@dpmconsultants.co.uk or call us on +44 79497 119 764. We’ll be happy to help you Get Ahead!
This article was developed with support from AI-based editorial tools and reviewed for accuracy. Any similarity to existing content is purely coincidental and unintended.
While every effort has been made to ensure the accuracy of the information contained in this publication, Data Protection Management Consultants (DPMC) Get Ahead® accepts no responsibility for any errors, omissions, or misstatements. The content is provided for general guidance only and should not be relied upon as legal or professional advice. Readers are encouraged to consult official sources or seek expert counsel, as this article has been published for informational purposes only and should not be relied upon for decision-making.
