Wooden letter tiles spell 'Breach' against a blurred natural background, concept of security or violation.
|

The 72-Hour Rule: When and How to Notify the ICO

ByPrivacyiQ

Fail to notify the ICO of a notifiable breach within 72 hours, and your risk of fines increases. Here’s what to know.

When a personal data breach occurs and is likely to result in a hig risk to individuals, you must notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware.

Your report must include:

  • Nature of the breach
  • Categories and volume of affected data
  • Consequences of the breach
  • Measures taken or proposed

Delays must be justified. Keep internal documentation even if the breach isn’t reported.

Tip: Set up an internal breach notification process so that teams act quickly.

Similar Posts

Can a Data Processor Cause a Breach and are you Still Liable?
|

Can a Data Processor Cause a Breach and are you Still Liable?

ByPrivacyiQ

You can outsource processing, but not responsibility. Here’s what to do if your vendor causes a breach. If your third-party processor causes a breach, you are still the controller — and responsible under UK GDPR. Key steps to protect yourself: Outsourcing doesn’t mean offloading accountability. Choose vendors who take GDPR seriously.